Database/Firmware, BMC & network fabric
swtpm (state blob header parsing): An invalid hdrsize in swtpm's saved state header causes an out-of-bounds access
Impact
An invalid hdrsize in swtpm's saved state header causes an out-of-bounds access, crashing swtpm or preventing it from starting. The operationally sharp version: a VM whose vTPM will not start cannot unseal its disk key, so a corrupted or tampered state blob is a data-availability event, not just a crash. On a GPU cloud that migrates or restores VMs, a bad state file taken across a migration bricks the guest's boot.
Who can reach it
Whoever can write the swtpm state file - host-level access, a compromised migration path, or corruption in the storage holding VM state. Not reachable from inside a well-isolated guest.
What to do
Package update to swtpm 0.5.3 / 0.6.2 / 0.7.1 or later on hypervisor hosts, then restart swtpm processes - package-level, no reboot of the host required. Worth pairing with an operational control: treat vTPM state blobs as data whose integrity you protect and back up, because losing one is equivalent to losing the guest's disk encryption key.
References
Related entries
- Supermicro BMC (IPMI web interface): Part of the same 2023 Supermicro BMC web-interface batchCVE-2023-40286 · Supermicro BMC (IPMI web interface)Unscored
- Linux x86/srso - SRSO mitigation missing for Hygon processors: The kernel's Speculative Return Stack OverflowCVE-2023-52482 · Linux x86/srso - SRSO mitigation missing for Hygon processorsUnscored
- Linux KVM/SVM - source vCPU selection in SEV-ES intra-host migration: KVM fetched source vCPUs from the wrong VMCVE-2023-54296 · Linux KVM/SVM - source vCPU selection in SEV-ES intra-host migrationUnscored
- tpm2-tools (tpm2_checkquote TPM2_GENERATED magic validation): tpm2_checkquote does not verify that the structureCVE-2024-29038 · tpm2-tools (tpm2_checkquote TPM2_GENERATED magic validation)Unscored
- tpm2-tools (tpm2_checkquote PCR selection handling): tpm2_checkquote does not validate the TPML_PCR_SELECTIONCVE-2024-29039 · tpm2-tools (tpm2_checkquote PCR selection handling)Unscored
- Linux kernel mlxbf_gige (BlueField out-of-band management NIC): NULL function-pointer dereference when the DPU'sCVE-2024-35907 · Linux kernel mlxbf_gige (BlueField out-of-band management NIC)Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.