Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue
Priority LOW 26CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00191 8th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 11 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stefanberger | libtpms | = 0.7.11; = 0.8.9; = 0.9.6; = 0.10.0 | — | No fix listed | CNA |
- libtpms Vendorstefanberger Affected = 0.7.11; = 0.8.9; = 0.9.6; = 0.10.0 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libtpms_project:libtpms:0.7.11:*:*:*:*:*:*:* | 0.7.11 | Vulnerable | Libtpms Project |
| cpe:2.3:a:libtpms_project:libtpms:0.8.9:*:*:*:*:*:*:* | 0.8.9 | Vulnerable | Libtpms Project |
| cpe:2.3:a:libtpms_project:libtpms:0.9.6:*:*:*:*:*:*:* | 0.9.6 | Vulnerable | Libtpms Project |
| cpe:2.3:a:libtpms_project:libtpms:0.10.0:*:*:*:*:*:*:* | 0.10.0 | Vulnerable | Libtpms Project |
- cpe:2.3:a:libtpms_project:libtpms:0.7.11:*:*:*:*:*:*:* Versions 0.7.11 Vulnerable ·Libtpms Project
- cpe:2.3:a:libtpms_project:libtpms:0.8.9:*:*:*:*:*:*:* Versions 0.8.9 Vulnerable ·Libtpms Project
- cpe:2.3:a:libtpms_project:libtpms:0.9.6:*:*:*:*:*:*:* Versions 0.9.6 Vulnerable ·Libtpms Project
- cpe:2.3:a:libtpms_project:libtpms:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Vulnerable ·Libtpms Project
Remediation
Red Hat 7 advisories
- RHSA-2025:16428 Released 2025-09-23 · Red Hat rating Moderatelibtpms security update
- Red Hat Enterprise Linux AppStream (v. 10) libtpms-0.9.6-11.el10_0
- RHSA-2025:12527 Released 2025-08-04 · Red Hat rating Moderatevirt:rhel and virt-devel:rhel security update
- Red Hat Enterprise Linux AppStream (v. 8) SLOF-20210217-2.module+el8.10.0+20141+6faa2812.noarch::virt:rhel, SLOF-20210217-2.module+el8.10.0+20141+6faa2812.src::virt:rhel, hivex-1.3.18-23.module+el8.9.0+18724+20190c23.aarch64::virt:rhel +47
- Red Hat Enterprise Linux CRB (v. 8) SLOF-20210217-2.module+el8.10.0+20141+6faa2812.src::virt-devel:rhel, hivex-1.3.18-23.module+el8.9.0+18724+20190c23.i686::virt-devel:rhel, hivex-devel-1.3.18-23.module+el8.9.0+18724+20190c23.i686::virt-devel:rhel +47
- RHSA-2025:12293 Released 2025-07-30 · Red Hat rating Moderatevirt:rhel and virt-devel:rhel security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) SLOF-20210217-2.module+el8.8.0+20737+daad9f3b.noarch::virt:rhel, SLOF-20210217-2.module+el8.8.0+20737+daad9f3b.src::virt:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.ppc64le::virt:rhel +47
- Red Hat Enterprise Linux AppStream TUS (v.8.8) hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.src::virt:rhel, hivex-1.3.18-23.module+el8.8.0+16781+9f4724c2.x86_64::virt:rhel, hivex-devel-1.3.18-23.module+el8.8.0+16781+9f4724c2.x86_64::virt:rhel +47
Show 4 more Red Hat advisories
- RHSA-2025:12234 Released 2025-07-30 · Red Hat rating Moderatevirt:rhel and virt-devel:rhel security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.src::virt:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64::virt:rhel, hivex-devel-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64::virt:rhel +47
- Red Hat Enterprise Linux AppStream E4S (v.8.6) SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.noarch::virt:rhel, SLOF-20210217-1.module+el8.6.0+14480+c0a3aa0f.src::virt:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.aarch64::virt:rhel +47
- Red Hat Enterprise Linux AppStream TUS (v.8.6) hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.src::virt:rhel, hivex-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64::virt:rhel, hivex-devel-1.3.18-23.module+el8.6.0+14480+c0a3aa0f.x86_64::virt:rhel +47
- RHSA-2025:12111 Released 2025-07-29 · Red Hat rating Moderatelibtpms security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) libtpms-0.9.1-5.20211126git1ff6fe1f43.el9_4
- RHSA-2025:12112 Released 2025-07-29 · Red Hat rating Moderatelibtpms security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) libtpms-0.9.1-5.20211126git1ff6fe1f43.el9_2
- RHSA-2025:12100 Released 2025-07-29 · Red Hat rating Moderatelibtpms security update
- Red Hat Enterprise Linux AppStream (v. 9) libtpms-0.9.1-5.20211126git1ff6fe1f43.el9_6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 Advanced Virtualization | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:16428 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:12527 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:12100 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:12234 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:12234 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:12293 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:12112 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:12111 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:12234 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:12293 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2025:12527 |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-49133
References
More Libtpms Project Libtpms vulnerabilities
- TI-2021-02679 Memory corruption in libtpms CVSS 3.1MEDIUM 6.5
- TI-2021-02569 Out-of-bounds write in libtpms CVSS 3.1MEDIUM 6.1
- TI-2021-02464 A flaw was found in libtpms in versions before 0.8.0. CVSS 3.1MEDIUM 5.5
- TI-2021-02518 Buffer overflow in libtpms CVSS 3.1MEDIUM 5.5
- TI-2021-02410 Broken or risky cryptographic algorithm in libtpms CVSS 3.1MEDIUM 5.5
- TI-2026-17328 libtpms returns wrong initialization vector when certain symmetric ciphers are used CVSS 3.1MEDIUM 5.5
Sources
- CVE-2025-49133 · CVE Program
- CVE-2025-49133 · NVD
- FIRST EPSS
- CVE-2025-49133 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences