Executive brief
libtpms is a software library that emulates a Trusted Platform Module (TPM) for virtual machines. A flaw in how it processes TPM state data during virtual machine startup or migration allows an attacker to crash the TPM emulation process, taking the virtual machine offline. The vulnerability cannot be exploited for data theft or unauthorized access, only to disrupt service availability.
Technical details
This is an out-of-bounds heap read vulnerability (CWE-125) in the TPM 2.0 state deserialization code. When libtpms restores TPM state from a blob, a malformed skip-block length field is not validated against the input buffer size. This causes an internal size counter to wrap negative (signed integer underflow), which then bypasses a subsequent bounds check due to unsafe signed-to-unsigned conversion, leading to out-of-bounds memory reads. The vulnerability requires the attacker to supply or tamper with the TPM state blob (AV:Adjacent for swtpm migration scenarios). Exploitation crashes the process hosting libtpms (such as swtpm), resulting in denial of service of the virtual TPM device. A patch is available via upstream libtpms repository commit b1462888180d896af03cae0487e8d45009cc445e.
Affected products
- libtpms libtpms all versions with TPM 2.0 support (--with-tpm2 build flag, the default)
Timeline
- 2026-09-04: disclosed
- 2026: patched: Fix available at https://github.com/stefanberger/libtpms/commit/b1462888180d896af03cae0487e8d45009cc445e