CVE-2023-22745 — tpm2-tss is an open source software implementation of the Trusted Computing Grou
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8
Published
2023-01-19T22:12:40.208Z
Last modified
2025-11-21T19:10:18.693Z
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
01What is this vulnerability?
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for…
02Affected products
| Vendor | Product | Versions |
|---|
| tpm2-software | tpm2 | tss — < 4.0.1, < 3.2.2-rc0 |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.
08Timeline
- Published: 2023-01-19T22:12:40.208Z
- Last modified: 2025-11-21T19:10:18.693Z
09References
- github.com — https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx6…
- github.com — https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69…
- github.com — https://github.com/tpm2-software/tpm2-tss/commit/49107d65d5c7be430671398416bbd89…
- github.com — https://github.com/tpm2-software/tpm2-tss/commit/7ab42953216adec046d000a5e3085f3…
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →