Nyob rau hauv cov cai nrog rau kev siv ntawm TPM 2.0 (Trusted Platform Module) specification, qhov tsis zoo tau raug txheeb xyuas (CVE-2023-1017, CVE-2023-1018) uas ua rau kev sau ntawv lossis nyeem cov ntaub ntawv dhau ntawm cov ciam teb ntawm qhov tsis sib faib. Kev tawm tsam ntawm kev siv cov txheej txheem crypto siv cov txheej txheem tsis zoo tuaj yeem ua rau muaj kev rho tawm lossis sau cov ntaub ntawv khaws cia hauv chip xws li cov yuam sij cryptographic. Lub peev xwm los sau cov ntaub ntawv hauv TPM firmware tuaj yeem siv los ntawm tus neeg tawm tsam los teeb tsa kev ua tiav ntawm lawv cov cai hauv cov ntsiab lus ntawm TPM, uas, piv txwv li, tuaj yeem siv los siv cov backdoors uas ua haujlwm ntawm TPM sab thiab tsis raug kuaj pom. los ntawm lub operating system.
Qhov tsis zoo yog tshwm sim los ntawm kev txheeb xyuas tsis raug ntawm qhov loj ntawm qhov tsis sib xws ntawm CryptParameterDecryption() muaj nuj nqi, uas tso cai rau ob bytes sau lossis nyeem dhau ntawm tus ciam teb ntawm qhov tsis dhau mus rau ExecuteCommand() muaj nuj nqi thiab muaj cov lus txib TPM2.0. Nyob ntawm qhov kev siv firmware, ob lub bytes raug overwritten tuaj yeem ua rau tsis siv lub cim xeeb thiab cov ntaub ntawv lossis cov taw qhia ntawm pawg.
Qhov tsis zoo yog siv los ntawm kev xa cov lus txib tsim tshwj xeeb rau TPM module (tus neeg tawm tsam yuav tsum muaj kev nkag mus rau TPM interface). Cov teeb meem tau daws nyob rau hauv TPM 2.0 specification hloov tshiab tso tawm thaum Lub Ib Hlis (1.59 Errata 1.4, 1.38 Errata 1.13, 1.16 Errata 1.6).
Lub libtpms qhib lub tsev qiv ntawv, siv rau software emulation ntawm TPM modules thiab kev koom ua ke ntawm TPM kev txhawb nqa rau hauv hypervisors, kuj yog qhov tsis zoo. Qhov tsis zoo tau raug kho hauv libtpms 0.9.6 tso tawm.
Tau qhov twg los: opennet.ru