New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

Mar 03, 2023Ravie LakshmananEnterprise Security / IoT

A pair of serious security defects has been disclosed in the
Trusted Platform Module (TPM^[1]) 2.0 reference library
specification that could potentially lead to information disclosure
or privilege escalation.

One of the vulnerabilities, CVE-2023-1017,
concerns an out-of-bounds write, while the other,
CVE-2023-1018, is described as an out-of-bounds
read. Credited with discovering and reporting the issues in
November 2022 is cybersecurity company Quarkslab.

“These vulnerabilities can be triggered from user-mode
applications by sending malicious commands to a TPM 2.0 whose
firmware is based on an affected TCG reference implementation,” the
Trusted Computing Group (TCG) said^[2]
in an advisory.

Large tech vendors, organizations using enterprise computers,
servers, IoT devices, and embedded systems that include a TPM can
be impacted by the flaws, Quarkslab noted^[3], adding they “could
affect billions of devices.”

TPM is a hardware-based solution (i.e., a crypto-processor)
that’s designed to provide secure cryptographic functions and
physical security mechanisms to resist tampering efforts.

“The most common TPM functions are used for system integrity
measurements and for key creation and use,” Microsoft says^[4]
in its documentation. “During the boot process of a system, the
boot code that is loaded (including firmware and the operating
system components) can be measured and recorded in the TPM.”

“The integrity measurements can be used as evidence for how a
system started and to make sure that a TPM-based key was used only
when the correct software was used to boot the system.”

The TCG consortium noted that the shortcomings are the result of
a lack of necessary length checks, resulting in buffer overflows
that could pave the way for local information disclosure or
escalation of privileges.

Users are recommended to apply the updates^[5]
released by TCG as well as other vendors to address the flaws and
mitigate supply chain risks.

“Users in high-assurance computing environments should consider
using TPM Remote Attestation to detect any changes to devices and
ensure their TPM is tamper proofed,” the CERT Coordination Center
(CERT/CC) said^[6]
in an alert.