CVE-2023-1017

—

CVSS 3.1

7.8 high

EPSS

1%p68

Published

Feb 28, 2023 (Feb 28, 2023)

Modified

Jun 17, 2026

Description

An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.

Vendors: trustedcomputinggroup microsoft
Products: trusted platform module, windows 10 1507, windows 10 1607, windows 10 1809, windows 10 20h2, windows 10 21h2, windows 10 22h2, windows 11 21h2, windows 11 22h2, windows server 2016, windows server 2019, windows server 2022
Weakness: CWE-787
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news5 stories

Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass and Firmware Exploits

The Hacker NewsJan 24, 12:47 UTC · Jan 24, 2025Vulnerability CVE-2020-10713 CVE-2022-24030 CVE-2021-33627+5 CVEs

Microsoft Rolls Out Patches for 80 New Security Flaws — Two Under Active Attack

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2023Vulnerability in the wildCVE-2023-23397 CVE-2023-24880 CVE-2022-44698+10 CVEs

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

The Hacker NewsMar 3, 11:14 UTC · Mar 3, 2023Vulnerability CVE-2023-1017 CVE-2023-1018

Friday Squid Blogging: We're Almost at Flying Squid Drones

Schneier on SecurityMar 3, 22:23 UTC · Mar 3, 2023Vulnerability CVE-2023-1017 CVE-2023-1018

Trusted Platform Module 2.0 flaws could impact billions of devices

Security AffairsMar 3, 13:49 UTC · Mar 3, 2023Vulnerability CVE-2023-1017 CVE-2023-1018