A TPM 2.0 (Trusted Platform Module) specification reference implementation has identified vulnerabilities (CVE-2023-1017, CVE-2023-1018) that allow writing or reading data outside the allocated buffer. Attacks on implementations of cryptoprocessors using vulnerable code may result in the extraction or overwriting of information stored on the chip, such as cryptographic keys. The possibility of overwriting data in TPM firmware can be exploited by an attacker to execute their code within the TPM context, which, for example, can be used to implement backdoors that operate on the TPM side and are undetectable from the operating system.
The vulnerabilities arise from improper size checks on the parameters of the CryptParameterDecryption() function, allowing reading or writing of two bytes beyond the buffer passed to the ExecuteCommand() function, which contains the TPM 2.0 command. Depending on the firmware implementation, the two bytes that are overwritten can damage both unused memory and data or pointers in the stack.
Exploitation of the vulnerability is carried out by sending specially crafted commands to the TPM module (the attacker must have access to the TPM interface). The issues have been addressed in the January release of the TPM 2.0 specification (1.59 Errata 1.4, 1.38 Errata 1.13, 1.16 Errata 1.6).
The open library libtpms, which is used for software emulation of TPM modules and integration of TPM support into hypervisors, is also susceptible to vulnerabilities. The vulnerability has been fixed in the libtpms 0.9.6 release.
Forrás: opennet.ru
