Description

A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T18:18:07.153Z",
  "pubdate": "2026-09-04T18:18:07.153Z",
  "executiveSummary": "A critical out-of-bounds memory read vulnerability exists in libtpms during the restoration of TPM 2.0 state blobs.\nThe flaw stems from insufficient validation of skip-block length parameters when parsing serialized state data, allowing an attacker to manipulate internal size counters.\nThis vulnerability primarily impacts systems utilizing libtpms, such as the swtpm TPM emulator, which are frequently integrated into virtual machine environments.\nSuccessful exploitation results in an out-of-bounds heap memory access, causing a process crash and leading to a Denial of Service (DoS) for the virtual machine dependent on the emulated TPM.\nThe vulnerability does not currently support code execution or information disclosure based on confirmed reports.\nExploitation requires the ability to provide a malformed state blob during the TPM state restoration process, typically occurring during VM migration or power-on sequences.",
  "technicalDetails": "The root cause of the vulnerability resides in the state restoration logic of libtpms, where the library deserializes TPM 2.0 state blobs. During the parsing of these blobs, the library processes skip-block segments intended to manage state data layout.\nThe vulnerability is triggered when a maliciously crafted state blob provides an oversized skip-block length value. The parser fails to perform an adequate bounds check against the total remaining size of the input buffer before utilizing this length.\nWhen the oversized value is processed, the internal size counter is driven into a negative state. In the subsequent logic, an unsafe signed-to-unsigned integer conversion occurs. This type-mismatch effectively transforms the negative value into a large positive integer, bypassing standard bounds checking mechanisms.\nThis invalid size value leads the parser to perform read operations beyond the heap buffer's allocated range. By reading memory outside the intended buffer boundaries, the parser attempts to access unauthorized heap memory regions.\nThe attack flow follows a structured sequence: First, the attacker provides a malformed state blob to the libtpms library via the interface responsible for state restoration (e.g., loading a saved virtual machine state). Second, the parser interprets the skip-block length without verifying it against the buffer's capacity. Third, the arithmetic overflow/underflow occurs, creating a manipulated pointer offset. Fourth, the library attempts to read from this invalid memory address, triggering a segmentation fault or a memory access violation.\nThe primary impact is the immediate termination of the process hosting libtpms, such as the swtpm process. This results in the loss of the TPM emulator service, effectively rendering the virtual machine unable to perform cryptographic operations or verify platform integrity, leading to a Denial of Service condition.\nThere is no requirement for network exposure, as the attack is locally exploitable if the attacker has the ability to supply a state file or influence the restoration process. The vulnerability does not require authentication within the host system itself if the attacker can influence the TPM state files used by the virtualization stack."
}