CVE-2025-1122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1122
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

6.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://issues.chromium.org/issues/b/324336238 Broken Link
https://issuetracker.google.com/issues/324336238 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:google:chrome:122.0.6261.132:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
History

06 Oct 2025, 16:56

Type Values Removed Values Added
CPE cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:a:google:chrome:122.0.6261.132:*:*:*:*:*:*:*
First Time Google chrome Os
Google
Google chrome
References () https://issues.chromium.org/issues/b/324336238 - () https://issues.chromium.org/issues/b/324336238 - Broken Link
References () https://issuetracker.google.com/issues/324336238 - () https://issuetracker.google.com/issues/324336238 - Exploit, Issue Tracking

06 May 2025, 01:15

Type Values Removed Values Added
Summary (en) Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process. (en) Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

17 Apr 2025, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.7
CWE CWE-787
Summary (en) Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process. (en) Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

16 Apr 2025, 13:25

Type Values Removed Values Added
Summary
  • (es) La escritura fuera de los límites en TPM2 Reference Library in Google ChromeOS 122.0.6261.132 estable en placas Cr50 permite que un atacante con acceso de root obtenga persistencia y eluda la verificación del sistema operativo mediante la explotación de la funcionalidad NV_Read durante el proceso de desafío-respuesta.

15 Apr 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-15 20:15

Updated : 2025-10-06 16:56

NVD link : CVE-2025-1122

Mitre link : CVE-2025-1122

CVE.ORG link : CVE-2025-1122

JSON object : View

Products Affected

google

  • chrome_os
  • chrome
CWE
CWE-787

Out-of-bounds Write