Trusted Platform Module 2.0, better known as TPM 2.0, is a module whose specification details a secure cryptoprocessor that can store encryption keys to protect information. It was released mainly as a result of Microsoft setting a requirement to use Windows 11 without problems and as an additional security measure, however, researchers discovered two localized vulnerabilities in the TPM 2.0 reference library, so we found a compromised security module.

The two vulnerabilities see the TPM 2.0 library specification abused by ambush. Both vulnerabilities, CVE-2023-1017 and CVE-2023-1018, consist of an out-of-bounds write (out of bounds), which opens the door to write two additional bytes at the end of the order from TPM 2.0 itself within the routine CryptParameterDecryption.

If an attacker successfully exploits CVE-2023-1017, they would be able to perform a denial of service or execution of arbitrary code in the context of TPM, while with CVE-2023-1018 you can access to sensitive data stored in the module which include cryptographic keys, passwords and other compromising data. Exploitation of both vulnerabilities is undetectable other components present in the target device and also requires the execution of specifically designed commands.

Although TPM gained notoriety mainly after it was introduced as a requirement for Windows 11, it is also present in many Internet of Things (IoT) devices. IoT is one of the areas of greatest concern in the cyber security sector due to the large number of devices that are in operation and not properly maintained or downright unmaintained, which has opened the door for them to be exploited. by hacker groups that managed to launch powerful DDoS attacks.

In the case of Windows 11, the operating system is able to rely on the TPM for features such as DRM, Windows Defender, and BitLocker Full Disk Encryption, among others.

The Trusted Computing Group (TCG), the body that manages the TPM specification, has released an update to the TPM 2.0 specification library with guidance on how to address security flaws. For end users, it means an update in the near future (or at least should be) of the operating system and motherboard firmware. On both fronts, you must apply updates to protect yourself from the vulnerabilities found.

Images: Pixabay