Heap Overread in swtpm NVRAM Header Validation

Executive Summary

This is an out-of-bounds read vulnerability in swtpm's SWTPM_NVRAM_CheckHeader() function. The function incorrectly checks buffer length against the size of a pointer instead of the actual struct size. This allows a smaller buffer to pass validation, causing a heap overread when accessing the totlen field. On 64-bit systems it reads 2 extra bytes, on 32-bit systems 6 extra bytes. This may crash the daemon or leak heap data to logs.

The issue occurs because sizeof(bh) checks the pointer size (4 or 8 bytes) rather than sizeof(*bh) which should be 10 bytes for the blobheader struct.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the swtpm version and inspecting logs for heap overread events. Use 'swtpm --version' to verify if your version is below 0.10.2. Monitor logs for daemon crashes or heap data leaks during SWTPM_NVRAM_CheckHeader operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the swtpm daemon to terminate unexpectedly, leading to denial of service for associated virtual machines. It may also leak small amounts of sensitive heap data to logs. The impact varies by system architecture and memory allocator.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by potentially exposing sensitive data through heap data leaks in logs. The out-of-bounds read could allow unauthorized access to memory, violating confidentiality requirements in both regulations. Additionally, daemon termination could disrupt services, affecting availability standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade swtpm to version 0.10.2 or later immediately. If upgrading is not possible, restrict access to swtpm processes and monitor for suspicious activity. Consider disabling swtpm services if they are not critical.

Useful 0 Not Useful 0