Not rated
CVE-2025-2884 TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the…
Description
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| TPM2.0 1.83 | earliest → < 1.83 | 1.83 |
| SIMATIC CN 4100 | Versions not published | |
| SIMATIC Field PG M5 | Versions not published | |
| SIMATIC Field PG M6 26.01 | earliest → < 26.01.14 | 26.01.14 |
| SIMATIC IPC BX-32A 29.01 | earliest → < 29.01.09 | 29.01.09 |
| SIMATIC IPC BX-39A 29.01 | earliest → < 29.01.09 | 29.01.09 |
| SIMATIC IPC BX-56A 32.01 | earliest → < 32.01.09 | 32.01.09 |
| SIMATIC IPC BX-59A 32.01 | earliest → < 32.01.09 | 32.01.09 |
| SIMATIC IPC MD-57A 30.01 | earliest → < 30.01.10 | 30.01.10 |
Show the 16 other branches Hide the 16 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| SIMATIC IPC PX-32A 29.01 | earliest → < 29.01.09 | 29.01.09 |
| SIMATIC IPC PX-39A 29.01 | earliest → < 29.01.09 | 29.01.09 |
| SIMATIC IPC PX-39A PRO 29.01 | earliest → < 29.01.09 | 29.01.09 |
| SIMATIC IPC RW-528A 34.01 | earliest → < 34.01.02 | 34.01.02 |
| SIMATIC IPC RW-548A 34.01 | earliest → < 34.01.02 | 34.01.02 |
| SIMATIC IPC227E | Versions not published | |
| SIMATIC IPC277E | Versions not published | |
| SIMATIC IPC427E 21.01 | earliest → < 21.01.20 | 21.01.20 |
| SIMATIC IPC477E 21.01 | earliest → < 21.01.20 | 21.01.20 |
| SIMATIC IPC477E PRO 21.01 | earliest → < 21.01.20 | 21.01.20 |
| SIMATIC IPC627E 25.02 | earliest → < 25.02.16 | 25.02.16 |
| SIMATIC IPC647E 25.02 | earliest → < 25.02.16 | 25.02.16 |
| SIMATIC IPC677E 25.02 | earliest → < 25.02.16 | 25.02.16 |
| SIMATIC IPC847E 25.02 | earliest → < 25.02.16 | 25.02.16 |
| SIMATIC ITP1000 | Versions not published | |
| SIPLUS IPC427E 21.01 | earliest → < 21.01.20 | 21.01.20 |
References
- trustedcomputinggroup.org trustedcomputinggroup.org
- TPM2.0 Errata trustedcomputinggroup.org
- Vendor Advisory trustedcomputinggroup.org
- Vendor Patch github.com
- Related CVE www.cve.org
Timeline
- Published
- Last modified
Other CVEs of TPM2.0
The 5 CVEs of TPM2.0 →
CVE-2026-6726
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker…
7.9
High
CVE-2026-6727
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation
5.9
Medium
CVE-2023-1017
An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of…
Not rated
CVE-2023-1018
An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0…
5.5
Medium