CVE-2022-23645

An out-of-bounds read vulnerability was found in swtpm. The vulnerability exists due to a boundary condition when the byte array representing the state of the TPM is accessed. This flaw allows an attacker to send a specially crafted header, triggering an out-of-bounds read access on the byte array containing the TPM's state. This issue can crash swtpm or prevent it from starting.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No possible workarounds. Users should upgrade to swtpm v0.5.3, v0.6.2 or v0.7.1.