Security researchers at Quarkslab have discovered two critical vulnerabilities in the Trusted Platform Module (TPM) 2.0 reference library specification, prompting a massive effort to patch vulnerable devices across multiple vendors.
The vulnerabilities allow an attacker with authenticated local access to overwrite protected data in the TPM firmware and execute code attacks. The Trusted Computing Group (TCG) has issued an Errata document that documents the memory corruption issues and provides mitigation guidance.
The security flaws exist in the way the TPM reference spec processes parameters that are part of TPM commands. An OOB read vulnerability in the CryptParameterDecryption() routine allowed a 2-byte read access to data that was not part of the current session.
It was also possible to write 2-bytes past the end of the current command buffer, resulting in memory corruption. An attacker with access to a device built with a vulnerable version of the TPM can trigger this bug by sending crafted commands to the TPM.
TPM technology is commonly used in a variety of devices, from specialized enterprise-grade hardware to Internet of Things (IoT) appliances. With the growth of cloud computing and virtualization, software based TPM implementations have also gained popularity.
The discovery of these vulnerabilities has raised alarm bells because of the potential widespread impact on these devices. CERT coordination center urges users to apply any updates provided by hardware and software manufacturers through their supply chain as soon as possible.
In high-assurance computing environments, users should consider using TPM Remote Attestation to detect any changes to devices and ensure their TPM is tamper-proof.
As these attacks involve TPM-based software, mechanisms such as user-password or PIN protection and tpm-totp do not protect against attacks leveraging the memory corruption vulnerabilities.
Updating the firmware of TPM chips may be necessary, and this can be done through an OS vendor or the original equipment manufacturer (OEM). In some cases, the OEM may require resetting the TPM to its original factory default values as part of the update process.
