Critical Memory Management Vulnerabilities in libtpms: Potential Denial of Service and Code Execution Risks
Summary
USN-5933-1: libtpms vulnerabilities. Affects libtpms versions < 0.9.3-0ubuntu1.22.04.1. Fixed in 0.9.3-0ubuntu1.22.04.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtpms is a library that implements the Trusted Platform Module (TPM) 2.0 specification, providing cryptographic operations and secure storage for sensitive data. It is widely used in various applications to enhance security by managing cryptographic keys and performing secure operations. However, recent vulnerabilities have been identified that compromise its memory management, exposing systems to potential attacks.
Vulnerability Detail
Francisco Falcon discovered that libtpms does not properly manage memory during certain cryptographic operations. This oversight could allow an attacker to exploit the vulnerability, leading to a denial of service or, in some cases, the execution of arbitrary code. The vulnerabilities are tracked under CVE-2023-1017 and CVE-2023-1018, highlighting the critical nature of this issue and the need for immediate remediation.
How To Fix
Minimum fixed version
0.9.3-0ubuntu1.22.04.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libtpmsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The vulnerabilities in libtpms present significant risks that could compromise system security. It is imperative to update the package to the latest patched version to safeguard against potential attacks. Regular monitoring and prompt updates are essential for maintaining the integrity of your systems.
See every vulnerability recorded for libtpms →
FAQ
libtpms is a library that implements the TPM 2.0 specification, providing cryptographic functions and secure storage for sensitive data.
The vulnerabilities could lead to denial of service attacks or allow attackers to execute arbitrary code on affected systems.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate risks as soon as possible.
Detailed information about the vulnerabilities can be found in the Ubuntu Security Notices, specifically USN-5933-1.
Related vulnerabilities
Recent vulnerabilities recorded for libtpms.
