« Volver al listado

CVE-2020-24455

Estado: ModificadaMedia (6.7)—

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Fedoraproject — FedoraTpm2 Software Stack Project — Tpm2 Software Stack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-24455",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "TPM2 source",
          "versions": [
            {
              "status": "affected",
              "version": "before 3.01, before 2.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-02-26T03:15:12.213",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902167",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/2.4.3",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KPOENCMJU4DMT3BDNUBRK25B3DJ47UO/",
      "source": "secure@intel.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/202107-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1902167",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/2.4.3",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/3.0.1",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KPOENCMJU4DMT3BDNUBRK25B3DJ47UO/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202107-10",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-909"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3."
    },
    {
      "lang": "es",
      "value": "Una falta de inicialización de una variable en la fuente de TPM2 puede permitir a un usuario privilegiado habilitar potencialmente una escalada de privilegios por medio del acceso local. Esto afecta a tpm2-tss versiones anteriores a 3.0.1 y versiones anteriores a 2.4.3"
    }
  ],
  "lastModified": "2026-06-17T03:05:38.073",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8AAC7D7-B4CB-44F3-80E4-BF25738A1BE7",
              "versionEndExcluding": "2.4.3"
            },
            {
              "criteria": "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "191ABF55-E210-4BA4-880C-7D8EE0FEF9FC",
              "versionEndExcluding": "3.0.1",
              "versionStartIncluding": "3.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}