Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3746

A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.

Published

2021-10-19T15:15:08.003

Last Modified

2024-11-21T06:22:19.390

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

6.9

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application libtpms_project libtpms < 0.6.6 Yes
Application libtpms_project libtpms < 0.7.9 Yes
Application libtpms_project libtpms < 0.8.5 Yes
Operating System fedoraproject fedora 34 Yes
Operating System redhat enterprise_linux 8.0 Yes
Operating System redhat enterprise_linux 8.0 Yes
References