CVE-2023-1018

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-1018
An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://kb.cert.org/vuls/id/782720 Third Party Advisory US Government Resource
https://trustedcomputinggroup.org/about/security/ Vendor Advisory
https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf Vendor Advisory
https://kb.cert.org/vuls/id/782720 Third Party Advisory US Government Resource
https://trustedcomputinggroup.org/about/security/ Vendor Advisory
https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT0007-Advisory-FINAL.pdf Vendor Advisory
https://www.kb.cert.org/vuls/id/782720
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.16:*:*:*:*:*:*
cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.38:*:*:*:*:*:*
cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.59:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
History

04 Nov 2025, 20:16

Type Values Removed Values Added
References
  • () https://www.kb.cert.org/vuls/id/782720 -
Information

Published : 2023-02-28 18:15

Updated : 2025-11-04 20:16

NVD link : CVE-2023-1018

Mitre link : CVE-2023-1018

CVE.ORG link : CVE-2023-1018

JSON object : View

Products Affected

microsoft

  • windows_11_21h2
  • windows_10_1607
  • windows_server_2016
  • windows_server_2022
  • windows_11_22h2
  • windows_server_2019
  • windows_10_1809
  • windows_10_21h2
  • windows_10_1507
  • windows_10_20h2
  • windows_10_22h2

trustedcomputinggroup

  • trusted_platform_module
CWE
CWE-125

Out-of-bounds Read