Read the docs
TI-2022-07697 Aliases CVE-2022-23645

Out-of-bounds read in swtpm

Priority LOW 28CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Fix Partial swtpm (stefanberger): 0.5.3, 0.6.2Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
stefanbergerswtpmbefore 0.5.3; 0.6.0 to before 0.6.2; = 0.7.00.5.3, 0.6.2Patch availableCNA
  • swtpm Vendorstefanberger Affected before 0.5.3; 0.6.0 to before 0.6.2; = 0.7.0 Fixed in 0.5.3, 0.6.2 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:swtpm_project:swtpm:*:*:*:*:*:*:*:*before 0.5.3; 0.6.0 to before 0.6.2VulnerableSwtpm Project
cpe:2.3:a:swtpm_project:swtpm:0.7.0:-:*:*:*:*:*:*0.7.0VulnerableSwtpm Project
cpe:2.3:a:swtpm_project:swtpm:0.7.0:rc1:*:*:*:*:*:*0.7.0 rc1VulnerableSwtpm Project
cpe:2.3:a:swtpm_project:swtpm:0.7.0:rc2:*:*:*:*:*:*0.7.0 rc2VulnerableSwtpm Project
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:swtpm_project:swtpm:*:*:*:*:*:*:*:* Versions before 0.5.3; 0.6.0 to before 0.6.2 Vulnerable ·Swtpm Project
  • cpe:2.3:a:swtpm_project:swtpm:0.7.0:-:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Swtpm Project
  • cpe:2.3:a:swtpm_project:swtpm:0.7.0:rc1:*:*:*:*:*:* Versions 0.7.0 rc1 Vulnerable ·Swtpm Project
  • cpe:2.3:a:swtpm_project:swtpm:0.7.0:rc2:*:*:*:*:*:* Versions 0.7.0 rc2 Vulnerable ·Swtpm Project
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA swtpm (stefanberger) Fixed in 0.5.3, 0.6.2

Red Hat 2 advisories

  • RHSA-2022:8100 Released 2022-11-15 · Red Hat rating Low
    swtpm security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) swtpm-0.7.0-3.20211109gitb79fd91.el9, swtpm-libs-0.7.0-3.20211109gitb79fd91.el9, swtpm-tools-0.7.0-3.20211109gitb79fd91.el9
  • RHSA-2022:7472 Released 2022-11-08 · Red Hat rating Low
    virt:rhel and virt-devel:rhel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) SLOF-20210217-1.module+el8.7.0+16689+53d59bc2.src::virt-devel:rhel, hivex-1.3.18-23.module+el8.7.0+16689+53d59bc2.i686::virt-devel:rhel, hivex-devel-1.3.18-23.module+el8.7.0+16689+53d59bc2.i686::virt-devel:rhel +47
    • Red Hat Enterprise Linux AppStream (v. 8) SLOF-20210217-1.module+el8.7.0+16689+53d59bc2.noarch::virt:rhel, SLOF-20210217-1.module+el8.7.0+16689+53d59bc2.src::virt:rhel, hivex-1.3.18-23.module+el8.7.0+16689+53d59bc2.aarch64::virt:rhel +47

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8 Advanced VirtualizationAffectedNo fix yet: Fix deferred
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2022:7472
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2022:7472
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:8100
Not affected: 1 product
  • Red Hat Enterprise Linux 8 Advanced Virtualization

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23645

References

Patch 2

Advisory 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences