swtpm (state blob header parsing): An invalid hdrsize in swtpm's saved state header causes an out-of-bounds access

Impact

An invalid hdrsize in swtpm's saved state header causes an out-of-bounds access, crashing swtpm or preventing it from starting. The operationally sharp version: a VM whose vTPM will not start cannot unseal its disk key, so a corrupted or tampered state blob is a data-availability event, not just a crash. On a GPU cloud that migrates or restores VMs, a bad state file taken across a migration bricks the guest's boot.

Who can reach it

Whoever can write the swtpm state file - host-level access, a compromised migration path, or corruption in the storage holding VM state. Not reachable from inside a well-isolated guest.

What to do

Package update to swtpm 0.5.3 / 0.6.2 / 0.7.1 or later on hypervisor hosts, then restart swtpm processes - package-level, no reboot of the host required. Worth pairing with an operational control: treat vTPM state blobs as data whose integrity you protect and back up, because losing one is equivalent to losing the guest's disk encryption key.

References