{"id":"CVE-2023-22745","summary":"Buffer Overlow in TSS2_RC_Decode in tpm2-tss","details":"tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. Versions 4.1.0-rc0, 4.0.1, and 3.2.2-rc1 fix the issue.","aliases":["GHSA-4j3v-fh23-vx67"],"modified":"2026-08-12T14:50:35.954545Z","published":"2023-01-19T22:12:40.208Z","related":["ALSA-2023:6685","ALSA-2023:7166","SUSE-SU-2023:0526-1","SUSE-SU-2023:0613-1","openSUSE-SU-2024:12629-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22745.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22745.json"},{"type":"ADVISORY","url":"https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22745"},{"type":"FIX","url":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5"},{"type":"FIX","url":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7"},{"type":"FIX","url":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tpm2-software/tpm2-tss","events":[{"introduced":"0"},{"fixed":"f2303275a3b4529b2480de5de2baf087f62e7df8"},{"introduced":"b827242c15f6343f385eb7e075c9e74096cbb4d6"},{"fixed":"46a1079d5edaaba5268d18e7a7a461f2552c5465"},{"fixed":"306490c8d848c367faa2d9df81f5e69dab46ffb5"},{"fixed":"49107d65d5c7be430671398416bbd89dae4e34e7"},{"fixed":"7ab42953216adec046d000a5e3085f3ee5e9cabf"}],"database_specific":{"cpe":"cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.2.2"},{"introduced":"4.0.0"},{"fixed":"4.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["4.1.0-rc1","4.1.0-rc0","3.2.1","4.0.0","3.2.0","3.0.0","2.4.0","2.0.0","1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-22745.json","vanir_signatures_modified":"2026-08-12T14:50:35Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"test/unit/test_tss2_rc.c","function":"main"},"deprecated":false,"digest":{"function_hash":"210679546137724741037001588151874037456","length":1218},"id":"CVE-2023-22745-0319e4b5","signature_type":"Function"},{"id":"CVE-2023-22745-0bd56be7","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"file":"test/unit/test_tss2_rc.c","function":"main"},"deprecated":false,"digest":{"function_hash":"204064093621549859084906869475315467738","length":824}},{"deprecated":false,"digest":{"length":156,"function_hash":"218088611376052740940402826514781597383"},"id":"CVE-2023-22745-18026062","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"src/tss2-rc/tss2_rc.c","function":"unknown_layer_handler"}},{"signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"test/unit/test_tss2_rc.c","function":"main"},"deprecated":false,"digest":{"length":1218,"function_hash":"210679546137724741037001588151874037456"},"id":"CVE-2023-22745-2cfa9053","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"test/unit/test_tss2_rc.c","function":"test_custom_handler"},"deprecated":false,"digest":{"function_hash":"182110618467033884683978193331878840039","length":620},"id":"CVE-2023-22745-33139623"},{"source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"file":"src/tss2-rc/tss2_rc.c"},"deprecated":false,"digest":{"line_hashes":["175155527675725234282584628524148541148","23567128023151797515262071755044535935","246069061386680654964652272609164475271","317053638468776435130117046972868057196","273544491497178644508060489907716145726","32168314883317647211393153869998367397","332334334708390563159145155299411330838","231466411507703472447561467953752381176","256486060277900464150414024503665300954","100203091301140282490830830062163577972","48519959050036360211262107379558709304","62946738782964942369359072942712272509","321713299480784781204506439951265566850","59610478482568649494324819292043119128","33958196451259255076985691980273556146","84047839519626758488820882518956782927","147268084096708068266334779623255555612","81128235305904865454659180169877957610","196114647762815489413384562871668992420"],"threshold":0.9},"id":"CVE-2023-22745-4e65d669","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"src/tss2-rc/tss2_rc.c","function":"Tss2_RC_Decode"},"deprecated":false,"digest":{"function_hash":"62104052089286377825759825078223098491","length":627},"id":"CVE-2023-22745-4f02c9c8","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"182110618467033884683978193331878840039","length":620},"id":"CVE-2023-22745-51412f0c","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"test/unit/test_tss2_rc.c","function":"test_custom_handler"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["175155527675725234282584628524148541148","23567128023151797515262071755044535935","246069061386680654964652272609164475271","317053638468776435130117046972868057196","273544491497178644508060489907716145726","32168314883317647211393153869998367397","332334334708390563159145155299411330838","231466411507703472447561467953752381176","256486060277900464150414024503665300954","100203091301140282490830830062163577972","48519959050036360211262107379558709304","62946738782964942369359072942712272509","321713299480784781204506439951265566850","59610478482568649494324819292043119128","33958196451259255076985691980273556146","84047839519626758488820882518956782927","147268084096708068266334779623255555612","81128235305904865454659180169877957610","196114647762815489413384562871668992420"],"threshold":0.9},"id":"CVE-2023-22745-610c2aac","signature_type":"Line","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"src/tss2-rc/tss2_rc.c"}},{"id":"CVE-2023-22745-9827217e","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"file":"test/unit/test_tss2_rc.c","function":"test_custom_handler"},"deprecated":false,"digest":{"function_hash":"182110618467033884683978193331878840039","length":620}},{"digest":{"function_hash":"218088611376052740940402826514781597383","length":156},"id":"CVE-2023-22745-a4dd1b3f","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"src/tss2-rc/tss2_rc.c","function":"unknown_layer_handler"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"218088611376052740940402826514781597383","length":156},"id":"CVE-2023-22745-a5112d7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"file":"src/tss2-rc/tss2_rc.c","function":"unknown_layer_handler"}},{"deprecated":false,"digest":{"line_hashes":["126634302639959653755036627329680949387","196092249021504670097161779802200482716","90332454760094272248489186515054036492","79891519806361018900133012175209927382","95914502055682118326074923222407169010","51107693369683575149761039570257940314","172496355627255185672225025796286030669","5557156980887231434293513853665475631","213828210412642347337225541114718609237","51992140069610253985102355317595830564","279618971227684673329874254623029200314"],"threshold":0.9},"id":"CVE-2023-22745-ae6001e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"test/unit/test_tss2_rc.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"file":"test/unit/test_tss2_rc.c"},"deprecated":false,"digest":{"line_hashes":["126634302639959653755036627329680949387","196092249021504670097161779802200482716","90332454760094272248489186515054036492","79891519806361018900133012175209927382","200972985790167298922305710773492206440","230018321900227890248859590876405822075","172496355627255185672225025796286030669","278006329284038542309903556397741749147","237255761619912192494392600862427721195","190923893354037871797047063437502076091","247551885064562752559588635847257214783"],"threshold":0.9},"id":"CVE-2023-22745-b013904b"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"test/unit/test_tss2_rc.c"},"deprecated":false,"digest":{"line_hashes":["126634302639959653755036627329680949387","196092249021504670097161779802200482716","90332454760094272248489186515054036492","79891519806361018900133012175209927382","95914502055682118326074923222407169010","51107693369683575149761039570257940314","172496355627255185672225025796286030669","5557156980887231434293513853665475631","213828210412642347337225541114718609237","51992140069610253985102355317595830564","279618971227684673329874254623029200314"],"threshold":0.9},"id":"CVE-2023-22745-c310c951"},{"source":"https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89dae4e34e7","target":{"file":"src/tss2-rc/tss2_rc.c","function":"Tss2_RC_Decode"},"deprecated":false,"digest":{"function_hash":"62104052089286377825759825078223098491","length":627},"id":"CVE-2023-22745-d1c34fe0","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"62104052089286377825759825078223098491","length":627},"id":"CVE-2023-22745-dc815e12","signature_type":"Function","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3ee5e9cabf","target":{"function":"Tss2_RC_Decode","file":"src/tss2-rc/tss2_rc.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5","target":{"file":"src/tss2-rc/tss2_rc.c"},"deprecated":false,"digest":{"line_hashes":["175155527675725234282584628524148541148","23567128023151797515262071755044535935","246069061386680654964652272609164475271","317053638468776435130117046972868057196","273544491497178644508060489907716145726","32168314883317647211393153869998367397","332334334708390563159145155299411330838","231466411507703472447561467953752381176","256486060277900464150414024503665300954","100203091301140282490830830062163577972","48519959050036360211262107379558709304","62946738782964942369359072942712272509","321713299480784781204506439951265566850","59610478482568649494324819292043119128","33958196451259255076985691980273556146","84047839519626758488820882518956782927","147268084096708068266334779623255555612","81128235305904865454659180169877957610","196114647762815489413384562871668992420"],"threshold":0.9},"id":"CVE-2023-22745-ee77cc36"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}]}