Skip to content
Fencer Intel
medium 6.2

CVE-2022-23645 json

Out-of-bounds read in swtpm

published 4y ago modified 4mo ago also EUVD-2022-28593

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

Patch / fix

  • swtpm_project swtpm 0.5.3, 0.6.2
  • swtpm Debian 14, Debian 13, Debian 12 0.7.1-1

debian advisories DEBIAN-CVE-2022-23645

  • swtpm RHEL 9 0.7.0-3.20211109gitb79fd91.el9
  • swtpm-libs RHEL 9 0.7.0-3.20211109gitb79fd91.el9
  • swtpm-tools RHEL 9 0.7.0-3.20211109gitb79fd91.el9
  • SLOF RHEL 8 20210217-1.module+el8.7.0+16689+53d59bc2
  • hivex RHEL 8 1.3.18-23.module+el8.7.0+16689+53d59bc2
  • netcf RHEL 8 0.2.8-12.module+el8.7.0+16689+53d59bc2
  • swtpm RHEL 8 0.7.0-4.20211109gitb79fd91.module+el8.7.0+16689+53d59bc2
  • libnbd RHEL 8 1.6.0-5.module+el8.7.0+16689+53d59bc2

red hat advisories RHSA-2022:8100RHSA-2022:7472

  • swtpm SLE Module for Server Applications 15 SP3, SLE Micro 5.1, openSUSE Leap 15.3 0.5.3-150300.3.3.1

suse advisories SUSE-SU-2022:1297-1

  • swtpm openSUSE Tumbleweed 0.7.1-1.1

opensuse advisories openSUSE-SU-2024:11870-1

  • swtpm AlmaLinux 9 0.7.0-3.20211109gitb79fd91.el9
  • swtpm-libs AlmaLinux 9 0.7.0-3.20211109gitb79fd91.el9
  • swtpm-tools AlmaLinux 9 0.7.0-3.20211109gitb79fd91.el9

almalinux advisories ALSA-2022:8100

  • hivex Rocky Linux 8 1.3.18-23.module+el8.7.0+1084+97b81f61
  • hivex Rocky Linux 8 1.3.18-23.module+el8.6.0+847+b490afdd
  • netcf Rocky Linux 8 0.2.8-12.module+el8.7.0+1084+97b81f61
  • netcf Rocky Linux 8 0.2.8-12.module+el8.4.0+534+4680a14e
  • netcf Rocky Linux 8 0.2.8-12.module+el8.6.0+847+b490afdd
  • swtpm Rocky Linux 8 0.7.0-4.20211109gitb79fd91.module+el8.7.0+1084+97b81f61
  • libnbd Rocky Linux 8 1.6.0-5.module+el8.7.0+1084+97b81f61
  • libnbd Rocky Linux 8 1.6.0-5.module+el8.6.0+847+b490afdd

rocky linux advisories RLSA-2022:7472

Is CVE-2022-23645 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23645 updated cvss 5.5

swtpm: Unchecked header size indicator against expected size

  • Red Hat Enterprise Linux 8 Advanced Virtualization swtpm, swtpm-libs, swtpm-tools, swtpm-tools-pkcs11
    affected: workaround, no fix available “No possible workarounds. Users should upgrade to swtpm v0.5.3, v0.6.2 or v0.7.1.”
  • Red Hat CodeReady Linux Builder (v. 8) libnbd 1.6.0-5.module+el8.7.0+16689+53d59bc2, netcf 0.2.8-12.module+el8.7.0+16689+53d59bc2, hivex 1.3.18-23.module+el8.7.0+16689+53d59bc2, nbdfuse 1.6.0-5.module+el8.7.0+16689+53d59bc2, SLOF 20210217-1.module+el8.7.0+16689+53d59bc2, libvirt 8.0.0-10.module+el8.7.0+16689+53d59bc2, +38 more Red Hat Enterprise Linux AppStream (v. 8) libnbd 1.6.0-5.module+el8.7.0+16689+53d59bc2, netcf 0.2.8-12.module+el8.7.0+16689+53d59bc2, hivex 1.3.18-23.module+el8.7.0+16689+53d59bc2, nbdfuse 1.6.0-5.module+el8.7.0+16689+53d59bc2, nbdkit 1.24.0-4.module+el8.7.0+16689+53d59bc2, SLOF 20210217-1.module+el8.7.0+16689+53d59bc2, +104 more
    fixed: vendor fix “No possible workarounds. Users should upgrade to swtpm v0.5.3, v0.6.2 or v0.7.1.” RHSA-2022:7472
  • Red Hat Enterprise Linux AppStream (v. 9) swtpm 0.7.0-3.20211109gitb79fd91.el9, swtpm-libs 0.7.0-3.20211109gitb79fd91.el9, swtpm-tools 0.7.0-3.20211109gitb79fd91.el9
    fixed: vendor fix “No possible workarounds. Users should upgrade to swtpm v0.5.3, v0.6.2 or v0.7.1.” RHSA-2022:8100
  • Red Hat Enterprise Linux 8 Advanced Virtualization swtpm, swtpm-libs, swtpm-tools, swtpm-tools-pkcs11
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • stefanberger swtpm

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.