Comments (1)
Hi @sei-vsarvepalli ,
This came to my attention yesterday and reviewed the TCGVRT0007-Advisory-FINAL.pdf
and the CERCC reports. These vulnerabilities do not affect wolfTPM. It only affects software TPM (swtpm). There should also be no issues with any physical TPM devices.
The vulnerabilities are in the TPM reference code “CryptParameterDecryption()". The issue is the TPM side and handling of arguments where length is not checked that allows an attacker to read or write two bytes past the buffer.
Thanks,
David Garske, wolfSSL
from wolftpm.
Related Issues (20)
- Add TPM 2.0 example for seal and unseal (using PCR) HOT 3
- Add TPM 2.0 Parameter Encryption support HOT 4
- TPM2_GetTag does not return TPM_ST_SESSIONS when required HOT 1
- Expired wolfSSL CA certificate used in examples
- I2C driver for Nuvoton NPCT75x TPM2.0 module HOT 6
- Add a TPM signature verifier example
- Can't clear TPM chip HOT 2
- git commit fails even though no change was made HOT 3
- Build errors
- wolftpm C# wrapper needs to implement IDisposable instead of using Finalizer. HOT 2
- Error handling in C# wrapper HOT 2
- Fix the maximum clock speed for SLB9672
- wolfTPM is not thread-safe (`gActiveTPM` ought to be a thread-local) HOT 5
- Add more examples: TPM2_ActivateCredential() HOT 1
- Software-only implementations of TPM2_Duplicate() and TPM2_MakeCredential() HOT 1
- How to go through wolfTPM2_Init with gdb HOT 7
- Building in MSYS2: undefined reference to `__imp_wolfSSL.._ HOT 10
- keygen -rsa -eh failed with TPM_RC_BAD_AUTH HOT 7
- Stuck in TPM2_Startup(&startupIn) function HOT 11
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wolftpm.