CVE-2023-1017

An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.16:*:*:*:*:*:*
cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.38:*:*:*:*:*:*
cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.59:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*

History

01 Apr 2024, 15:50

Type Values Removed Values Added
First Time Microsoft windows 10 1607
Microsoft windows 10 22h2
Microsoft windows Server 2022
Microsoft
Microsoft windows 10 1507
Microsoft windows 10 20h2
Microsoft windows 10 1809
Microsoft windows 11 22h2
Microsoft windows Server 2016
Microsoft windows 10 21h2
Microsoft windows Server 2019
Microsoft windows 11 21h2
CPE cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*

Information

Published : 2023-02-28 19:15

Updated : 2024-04-01 15:50


NVD link : CVE-2023-1017

Mitre link : CVE-2023-1017

CVE.ORG link : CVE-2023-1017


JSON object : View

Products Affected

microsoft

  • windows_11_21h2
  • windows_10_21h2
  • windows_10_22h2
  • windows_10_1607
  • windows_10_1507
  • windows_11_22h2
  • windows_server_2016
  • windows_10_20h2
  • windows_server_2019
  • windows_server_2022
  • windows_10_1809

trustedcomputinggroup

  • trusted_platform_module
CWE
CWE-787

Out-of-bounds Write