Stefanberger Swtpm 缓冲区错误漏洞

漏洞信息详情

Stefanberger Swtpm是Stefanberger个人开发者的一个基于Libtpms的软件模拟器。该软件支持套接字，字符设备和Linux CUSE接口等功能。

Stefanberger Swtpm 0.5.3之前版本, 0.6.2之前版本, 和0.7.1之前版本存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心编制的swtpm状态标头（blobheader的hdrsize指示符具有无效值）导致越界访问，引起系统崩溃或阻止其启动。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/stefanberger/swtpm/security/advisories/GHSA-2qgm-8xf4-3hqw

来源:CONFIRM

链接:https://github.com/stefanberger/swtpm/security/advisories/GHSA-2qgm-8xf4-3hqw

来源:MISC

链接:https://github.com/stefanberger/swtpm/commit/9f740868fc36761de27df3935513bdebf8852d19

来源:MISC

链接:https://github.com/stefanberger/swtpm/releases/tag/v0.5.3

来源:MISC

链接:https://github.com/stefanberger/swtpm/releases/tag/v0.6.2

来源:MISC

链接:https://github.com/stefanberger/swtpm/releases/tag/v0.7.1

来源:cxsecurity.com

链接:https://cxsecurity.com/cveshow/CVE-2022-23645/

来源:access.redhat.com

链接:https://access.redhat.com/security/cve/cve-2022-23645

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2022022107

暂无