> CVE-2025-49133 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2025-06-10 20:15
MODIFIED
2025-10-01 15:11
CVSS_SCORE V3
5.9
EPSS (Prob. Exploit)
0.19%
Top 91.2%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08 MSRC 🔗 2026-05-01

> DESCRIPTION

Libtpms is a library that targets the integration of TPM functionality into hypervisors, primarily into Qemu. Libtpms, which is derived from the TPM 2.0 reference implementation code published by the Trusted Computing Group, is prone to a potential out of bounds (OOB) read vulnerability. The vulnerability occurs in the ‘CryptHmacSign’ function with an inconsistent pairing of the signKey and signScheme parameters, where the signKey is ALG_KEYEDHASH key and inScheme is an ECC or RSA scheme. The reported vulnerability is in the ‘CryptHmacSign’ function, which is defined in the "Part 4: Supporting Routines – Code" document, section "7.151 - /tpm/src/crypt/CryptUtil.c ". This vulnerability can be triggered from user-mode applications by sending malicious commands to a TPM 2.0/vTPM (swtpm) whose firmware is based on an affected TCG reference implementation. The effect on libtpms is that it will cause an abort due to the detection of the out-of-bounds access, thus for example making a vTPM (swtpm) unavailable to a VM. This vulnerability is fixed in 0.7.12, 0.8.10, 0.9.7, and 0.10.1.

> AFFECTED_PRODUCTS

Libtpms Project - Libtpms
Version: 0.7.11
Libtpms Project - Libtpms
Version: 0.8.9
Libtpms Project - Libtpms
Version: 0.9.6
Libtpms Project - Libtpms
Version: 0.10.0

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Local (L)
Exploit nécessite un accès local au système
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
Low (L)
Authentifié avec compte utilisateur basique
UI (Interaction Utilisateur)
User Interaction
Required (R)
Nécessite une action utilisateur (clic lien, ouverture fichier, etc.)
S (Périmètre)
Scope
Changed (C)
Impact s'étend au-delà du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
None (N)
Aucune divulgation d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
High (H)
Interruption totale du service possible

> RÉSUMÉ DES IMPACTS

Confidentialité
None
Aucune divulgation d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
High
Interruption totale du service possible

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: libtpms security update
An update for libtpms is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: virt:rhel and virt-devel:rhel security update
An update for the virt:rhel and virt-devel:rhel module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Commo...
Red Hat Security Advisory: virt:rhel and virt-devel:rhel security update
An update for the virt:rhel and virt-devel:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Se...
Red Hat Security Advisory: virt:rhel and virt-devel:rhel security update
An update for the virt:rhel and virt-devel:rhel module is now available for Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Updat...
Red Hat Security Advisory: libtpms security update
An update for libtpms is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulne...
Red Hat Security Advisory: libtpms security update
An update for libtpms is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Co...
Red Hat Security Advisory: libtpms security update
An update for libtpms is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (C...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Moderate

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue

AFFECTED PACKAGES:
Unknown / Unknown
8 versions affected
ALIASES:
GHSA-25w5-6fjj-hf8g

> HISTORIQUE DES MODIFICATIONS

Première apparition
10/06/2025 20:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:04
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:13
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Moderate", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:13
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME