libtpms: malformed TPM state blob drives an out-of-bounds heap read and kills the VM's vTPM

Impact

libtpms does not validate a skip-block length in a saved TPM 2.0 state blob against the remaining input buffer. The oversized value drives an internal size counter negative and a signed-to-unsigned conversion lets it pass the following bounds check, so the parser reads past the end of the heap buffer holding the state. The process hosting libtpms - normally swtpm - crashes, which takes the emulated TPM and the guest that depends on it down with it. On a GPU host that means a VM with passed-through accelerators dies at power-on or at the end of a migration, and it will not come back until it is given a state blob the parser accepts. Red Hat reports no confirmed data corruption or information disclosure.

Who can reach it

Whoever controls the TPM state blob presented at guest power-on or state/migration restore - a migration peer, or anyone who can write the stored state file. Red Hat scores it AV:A/PR:N, i.e. adjacent-network and unauthenticated, so a hostile or compromised migration source is the path to consider on a shared management network.

What to do

Take the libtpms update from your distribution (Red Hat has advisories for RHEL 8, 9 and 10). The fix is commit b1462888180d896af03cae0487e8d45009cc445e. The library is loaded by swtpm, so patching it is not enough on its own: each running swtpm process keeps the old code until it restarts, and swtpm restarts with the guest, so affected VMs have to be stopped and started rather than carried across live.

References

Related entries

• Xen (x86 PV): Race condition in typeref acquisition - PV guest escalates to host privilegeCVE-2022-26362 · Xen (x86 PV)Medium
• QEMU (IDE/ATAPI): Improper IDE controller reset lets a guest overwrite the host MBR of an attached deviceCVE-2023-5088 · QEMU (IDE/ATAPI)Medium
• Intel DSA/IAA (idxd): Hardware erratum: direct access to Intel DSA/IAA accelerators by an untrusted application allowsCVE-2024-21823 · Intel DSA/IAA (idxd)Medium
• Linux kernel (drivers/pci): Pm_runtime_get_sync() does not wait for an already-running .runtime_idle() callback, so aCVE-2024-35809 · Linux kernel (drivers/pci)Medium
• Linux kernel (drivers/pci/hotplug): Powering off a physical function that still has child virtual functions drops theCVE-2025-37946 · Linux kernel (drivers/pci/hotplug)Medium
• systemd: Privilege escalation via the systemctl `less` pager when sudo-granted systemctl is availableCVE-2023-26604 · systemdMedium