CVE-2022-23645: Out-of-bounds read in swtpm
Vulnerability summary
CVE-2022-23645 is a medium (CVSS 6.2) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities.
Not severe (CVSS 6.2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 18-02-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat8 products
- enterprise_linux8.0
- swtpm< 0:0.7.0-3.20211109gitb79fd91.el9
- swtpm-debuginfo< 0:0.7.0-3.20211109gitb79fd91.el9
- swtpm-debugsource< 0:0.7.0-3.20211109gitb79fd91.el9
- swtpm-libs< 0:0.7.0-3.20211109gitb79fd91.el9
Opensuse2 products
- swtpm&distro=openSUSE Leap 15.3< 0.5.3-150300.3.3.1
- swtpm&distro=openSUSE Tumbleweed< 0.7.1-1.1
Suse2 products
- swtpm&distro=SUSE Linux Enterprise Micro 5.1< 0.5.3-150300.3.3.1
- swtpm&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 0.5.3-150300.3.3.1
Debian1 product
- swtpm< 0.7.1-1
Fedoraproject1 product
- fedoraEOL35
Mageia1 product
- swtpm< 0.7.1-1.mga8
Stefanberger1 product
- swtpm< 0.5.3 | ≥ 0.6.0, < 0.6.2 | = 0.7.0
Swtpm_project1 product
- swtpm< 0.5.3 | ≥ 0.6.0, < 0.6.2 | 0.7.0 | 0.7.0:rc1 | 0.7.0:rc2
Ubuntu1 product
- swtpm< 0.6.3-0ubuntu3
9 vendors · 18 products
References
23 links- github.com/stefanberger/swtpm/security/advisories/GHSA-2qgm-8xf4-3hqwX Refsource CONFIRMREPORTPatchThird Party Advisory
- github.com/stefanberger/swtpm/commit/9f740868fc36761de27df3935513bdebf8852d19X Refsource MISCPatchThird Party Advisory
- github.com/stefanberger/swtpm/releases/tag/v0.5.3X Refsource MISCREPORTRelease NotesThird Party Advisory
- github.com/stefanberger/swtpm/releases/tag/v0.6.2X Refsource MISCREPORTRelease NotesThird Party Advisory
- github.com/stefanberger/swtpm/releases/tag/v0.7.1X Refsource MISCREPORTRelease NotesThird Party Advisory
