EUVD-2025-17717Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H
Local attack vector, low complexity, low privileges, user interaction required.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
5DescriptionCVE.org
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
AnalysisAI
Out-of-bounds read in TCG TPM2.0 Reference Implementation's CryptHmacSign function allows local authenticated attackers to leak sensitive memory or cause denial of service. The vulnerability affects TPM2.0 library versions prior to 1.83 and is fixed in Errata Revision 1.83. No public exploit or active exploitation has been identified, and EPSS score is low (0.03%).
Technical ContextAI
The vulnerability resides in the CryptHmacSign helper function within the TPM2.0 reference implementation's cryptographic library (CryptUtil.c). The function fails to validate that the signature scheme (sigAlg) matches the signing key's algorithm type (e.g., HMAC vs. asymmetric schemes). This allows an attacker to supply a mismatched signature scheme, leading to an out-of-bounds read (CWE-125) when the function attempts to process the signature using incorrect parameters. The affected component is the TPM2.0 software stack, commonly used in trusted computing environments. CPE data indicates affected versions are TPM2.0 < 1.83.
RemediationAI
Upgrade to TPM2.0 Errata Revision 1.83 or later. The fix is available in the libtpms repository commit 04b2d8e9afc0a9b6bffe562a23e58c0de11532d1. For systems using TPM2.0 software stacks, apply the vendor patch or update to the latest version. No workarounds are documented; however, restricting local access to TPM commands and ensuring only trusted users can interact with the TPM can reduce risk.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today