CVE-2022-23645— Out-of-bounds read in swtpm
Quick assessment
Affected
stefanberger swtpm
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Stefanberger Swtpm是Stefanberger个人开发者的一个基于Libtpms的软件模拟器。该软件支持套接字，字符设备和Linux CUSE接口等功能。 Stefanberger Swtpm 0.5.3之前版本, 0.6.2之前版本, 和0.7.1之前版本存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心编制的swtpm状态标头（blobheader的hdrsize指示符具有无效值）导致越界访问，引起系统崩溃或阻止其启动。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-23645
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Out-of-bounds read in swtpm
Source: CVE Program / CVE List V5
Vulnerability Description
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Stefanberger Swtpm 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Stefanberger Swtpm是Stefanberger个人开发者的一个基于Libtpms的软件模拟器。该软件支持套接字，字符设备和Linux CUSE接口等功能。 Stefanberger Swtpm 0.5.3之前版本, 0.6.2之前版本, 和0.7.1之前版本存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心编制的swtpm状态标头（blobheader的hdrsize指示符具有无效值）导致越界访问，引起系统崩溃或阻止其启动。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| stefanberger | swtpm | < 0.5.3 | - |
|
II. Public POCs for CVE-2022-23645
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-23645
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-23645 (1)
Vendor Advisories for CVE-2022-23645 (1)
-
https://github.com/stefanberger/swtpm/security/advisories/GHSA-2qgm-8xf4-3hqw x_refsource_CONFIRM
Mailing List Discussions for CVE-2022-23645 (1)
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WL735FW266GO4C2JX4CJBOIOB7R7AY5A/ vendor-advisory x_refsource_FEDORA
Other References for CVE-2022-23645 (3)
-
https://github.com/stefanberger/swtpm/releases/tag/v0.5.3 x_refsource_MISC
-
https://github.com/stefanberger/swtpm/releases/tag/v0.6.2 x_refsource_MISC
-
https://github.com/stefanberger/swtpm/releases/tag/v0.7.1 x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-125
-
CVE-2026-13481
Out-of-bounds read in PTP management TLV TIME parsing in Zep -
CVE-2026-13479
Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink -
CVE-2026-80101
Gimp: multiple heap out-of-bounds reads in xwd loader from u -
CVE-2026-79112
Chrome<152.0.7977.65 Skia越界读取漏洞 -
CVE-2026-79239
Chrome < 152.0.7977.65 Tint越界读取漏洞
V. Comments for CVE-2022-23645
No comments yet