遠端 Oracle Linux 8 主機上安裝的套件受到 ELSA-2023-7166 公告中提及的一個弱點影響。

  - tpm2-tss 是 Trusted Computing Group (TCG) 可信平台模組 (TPM) 2 軟體堆疊 (TSS2) 的開放原始碼軟體實作。在受影響的版本中， Tss2_RC_SetHandler 和 Tss2_RC_Decode 都會以 8 位元層級編號與 layer_handler 建立索引，但陣列只有 TPM2_ERROR_TSS2_RC_LAYER_COUNT 項目，因此嘗試為編號較高的層級新增處理程式或解碼包含此層級編號的回應程式碼時會引致讀取/寫入範圍超過緩衝區的結尾。此緩衝區溢位問題可引致任意程式碼執行攻擊。針對 RC 傳回 0xFFFFFFFF 的 MiTM 匯流排攻擊就是一個範例。考慮到 TPM 模組的常見使用案例，攻擊者必須要能以本機系統權限從本機存取目標計算機，並且此存取權限允許存取 TPM 系統。通常，存取 TPM 需要具有管理權限。(CVE-2023-22745)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，它受到 ALAS2023-2023-110 公告中提及的一個弱點影響。

  - tpm2-tss 是 Trusted Computing Group (TCG) 可信平台模組 (TPM) 2 軟體堆疊 (TSS2) 的開放原始碼軟體實作。在受影響的版本中， Tss2_RC_SetHandler 和 Tss2_RC_Decode 都會以 8 位元層級編號與 layer_handler 建立索引，但陣列只有 TPM2_ERROR_TSS2_RC_LAYER_COUNT 項目，因此嘗試為編號較高的層級新增處理程式或解碼包含此層級編號的回應程式碼時會引致讀取/寫入範圍超過緩衝區的結尾。此緩衝區溢位問題可引致任意程式碼執行攻擊。針對 RC 傳回 0xFFFFFFFF 的 MiTM 匯流排攻擊就是一個範例。考慮到 TPM 模組的常見使用案例，攻擊者必須要能以本機系統權限從本機存取目標計算機，並且此存取權限允許存取 TPM 系統。通常，存取 TPM 需要具有管理權限。(CVE-2023-22745)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，该应用程序受到 ALAS2023-2023-110 公告中提及的漏洞的影响。

  - tpm2-tss 是 Trusted Computing Group (TCG) 受信任平台模块 (TPM) 2 软件堆栈 (TSS2) 的开源软件实现。在受影响的版本“Tss2_RC_SetHandler”和“Tss2_RC_Decode”中，均使用 8 位层数对“layer_handler”进行索引，但数组中只有“TPM2_ERROR_TSS2_RC_LAYER_COUNT”条目，因此尝试为更多的层添加处理程序或解码这样层数的响应代码会导致读取/写入超过缓冲区末尾。这种缓冲区溢出可能导致执行任意代码。为 RC 返回 0xFFFFFFF 的 MiTM 总线攻击便是其中一个攻击示例。鉴于 TPM 模块的常见用例，攻击者必须使用本地系统权限对可以访问 TPM 系统的目标计算机进行本地访问。通常，访问 TPM 需要提供管理权限 。(CVE-2023-22745)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 8 主机上安装的程序包受到 CESA-2023: 7166 公告中提及的一个漏洞的影响。

  - tpm2-tss 是 Trusted Computing Group (TCG) 受信任平台模块 (TPM) 2 软件堆栈 (TSS2) 的开源软件实现。在受影响的版本“Tss2_RC_SetHandler”和“Tss2_RC_Decode”中，均使用 8 位层数对“layer_handler”进行索引，但数组中只有“TPM2_ERROR_TSS2_RC_LAYER_COUNT”条目，因此尝试为更多的层添加处理程序或解码这样层数的响应代码会导致读取/写入超过缓冲区末尾。这种缓冲区溢出可能导致执行任意代码。为 RC 返回 0xFFFFFFF 的 MiTM 总线攻击便是其中一个攻击示例。鉴于 TPM 模块的常见用例，攻击者必须使用本地系统权限对可以访问 TPM 系统的目标计算机进行本地访问。通常，访问 TPM 需要提供管理权限 。(CVE-2023-22745)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 9 主机上安装的多个程序包受到 ELSA-2023-6685 公告中提及的一个漏洞影响。

  - tpm2-tss 是 Trusted Computing Group (TCG) 受信任平台模块 (TPM) 2 软件堆栈 (TSS2) 的开源软件实现。在受影响的版本“Tss2_RC_SetHandler”和“Tss2_RC_Decode”中，均使用 8 位层数对“layer_handler”进行索引，但数组中只有“TPM2_ERROR_TSS2_RC_LAYER_COUNT”条目，因此尝试为更多的层添加处理程序或解码这样层数的响应代码会导致读取/写入超过缓冲区末尾。这种缓冲区溢出可能导致执行任意代码。为 RC 返回 0xFFFFFFF 的 MiTM 总线攻击便是其中一个攻击示例。鉴于 TPM 模块的常见用例，攻击者必须使用本地系统权限对可以访问 TPM 系统的目标计算机进行本地访问。通常，访问 TPM 需要提供管理权限 。(CVE-2023-22745)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 8 主机上安装的多个程序包受到 ELSA-2023-7166 公告中提及的一个漏洞影响。

  - tpm2-tss 是 Trusted Computing Group (TCG) 受信任平台模块 (TPM) 2 软件堆栈 (TSS2) 的开源软件实现。在受影响的版本“Tss2_RC_SetHandler”和“Tss2_RC_Decode”中，均使用 8 位层数对“layer_handler”进行索引，但数组中只有“TPM2_ERROR_TSS2_RC_LAYER_COUNT”条目，因此尝试为更多的层添加处理程序或解码这样层数的响应代码会导致读取/写入超过缓冲区末尾。这种缓冲区溢出可能导致执行任意代码。为 RC 返回 0xFFFFFFF 的 MiTM 总线攻击便是其中一个攻击示例。鉴于 TPM 模块的常见用例，攻击者必须使用本地系统权限对可以访问 TPM 系统的目标计算机进行本地访问。通常，访问 TPM 需要提供管理权限 。(CVE-2023-22745)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0006 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-22745:
    tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform     Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both     index into `layer_handler` with an 8 bit layer number, but the array only has     `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode     a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun,     could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns     0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the     target machine with local system privileges which allows access to the TPM system. Usually TPM access     requires administrative privilege.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform     Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both     index into `layer_handler` with an 8 bit layer number, but the array only has     `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode     a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun,     could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns     0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the     target machine with local system privileges which allows access to the TPM system. Usually TPM access     requires administrative privilege. (CVE-2023-22745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform     Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both     index into `layer_handler` with an 8 bit layer number, but the array only has     `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode     a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun,     could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns     0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the     target machine with local system privileges which allows access to the TPM system. Usually TPM access     requires administrative privilege. (CVE-2023-22745)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7166 advisory.

  - tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform     Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both     index into `layer_handler` with an 8 bit layer number, but the array only has     `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode     a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun,     could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns     0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the     target machine with local system privileges which allows access to the TPM system. Usually TPM access     requires administrative privilege. (CVE-2023-22745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6685 advisory.

    [3.2.2-2]
    - Remove misapplied license       Resolves: rhbz#2160307

    [3.2.2-1]
    - Rebase to 3.2.2
    - Use systemd-sysusers to create user       Resolves: CVE-2023-22745       Resolves: rhbz#2095479       Resolves: rhbz#2160307       Resolves: rhbz#2162613

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7166 advisory.

    [2.3.2-5]
    - Ensure layer number is in bounds       Resolves: rhbz#2160302       Resolves: rhbz#2162611

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-25617e952a advisory.

    Fixed:

    * A buffer overflow in tss2-rc as CVE-2023-22745.
    * The drv layer in tss2-rc should have been the policy layer.
    * Spec deviation in Fapi_GetDescription caused description to be NULL when it should be empty string.
      This is API breaking but considered a bug since it deviated from the FAPI spec.
    * FAPI: undefined reference to curl_url_strerror when using curl less than 7.80.0.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-110 advisory.

    tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform     Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both     index into `layer_handler` with an 8 bit layer number, but the array only has     `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode     a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun,     could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns     0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the     target machine with local system privileges which allows access to the TPM system. Usually TPM access     requires administrative privilege. (CVE-2023-22745)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
186115	Oracle Linux 8：tpm2-tss (ELSA-2023-7166)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2024/10/22	medium
173177	Amazon Linux 2023：tpm2-tss、tpm2-tss-devel (ALAS2023-2023-110)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	medium
173177	Amazon Linux 2023：tpm2-tss、tpm2-tss-devel (ALAS2023-2023-110)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	medium
185646	CentOS 8：tpm2-tss (CESA-2023: 7166)	Nessus	CentOS Local Security Checks	2023/11/14	2023/11/14	medium
185856	Oracle Linux 9：tpm2-tss (ELSA-2023-6685)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
186115	Oracle Linux 8：tpm2-tss (ELSA-2023-7166)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2024/10/22	medium
236580	Alibaba Cloud Linux 3 : 0006: tpm2-tss (ALINUX3-SA-2024:0006)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
175509	EulerOS 2.0 SP9 : tpm2-tss (EulerOS-SA-2023-1882)	Nessus	Huawei Local Security Checks	2023/5/13	2023/5/13	medium
178999	EulerOS Virtualization 2.10.0 : tpm2-tss (EulerOS-SA-2023-2483)	Nessus	Huawei Local Security Checks	2023/7/28	2023/7/28	medium
185646	CentOS 8 : tpm2-tss (CESA-2023:7166)	Nessus	CentOS Local Security Checks	2023/11/14	2023/11/14	medium
185856	Oracle Linux 9 : tpm2-tss (ELSA-2023-6685)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
186115	Oracle Linux 8 : tpm2-tss (ELSA-2023-7166)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2024/10/22	medium
171240	Fedora 37 : tpm2-tss (2023-25617e952a)	Nessus	Fedora Local Security Checks	2023/2/9	2024/11/14	medium
173177	Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel (ALAS2023-2023-110)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2024/12/11	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium