CVE-2025-49133

A flaw was found in libtpms. A heap buffer overflow can occur in the tpms_parse_pssh function when parsing a malformed Public Signature Key Exchange (PSK) structure. A local attacker can trigger this overflow by providing a crafted PSK structure to the library. This can lead to a denial of service or allow for arbitrary code execution.

This vulnerability, identified as a potential out-of-bounds read, is triggered by inconsistent parameters within the CryptHmacSign function of the vTPM (virtual Trusted Platform Module). Although the attack is local to the system, it requires user interaction in the form of sending malicious commands to the vTPM. The primary impact is a denial-of-service (DoS) to the virtual machine (VM) by rendering its vTPM unavailable. This prevents the VM from utilizing critical TPM functionality, which can lead to significant operational disruption. While this flaw does not enable arbitrary code execution, the potential for DoS and broader system instability justifies a Moderate severity rating. The requirement for specific user interaction reduces its severity from what would otherwise be an Important classification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.