CVE-2023-1017: An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past

Q: How do I fix CVE-2023-1017?

trusted platform module: downgrade or apply the listed mitigation; windows 10 1507: upgrade to 10.0.10240.19805; windows 10 1607: upgrade to 10.0.14393.5786. Exact commands for each OS are on this page.

Q: Is CVE-2023-1017 being exploited?

CVE-2023-1017 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2023-1017 affect?

CVE-2023-1017 affects trusted platform module, windows 10 1507, windows 10 1607. Severity is high (CVSS 7.8). An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can

Q: How urgent is CVE-2023-1017?

Priority 50/100. High severity; On your watchlist

This month

HIGH 7.8WATCHLISTDOWNGRADEUPGRADEUPGRADE

CVE-2023-1017 is a high-severity flaw (CVSS 7.8) affecting trusted platform module, windows 10 1507, windows 10 1607. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context.

Why this priority

High severity
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.8 (High)
Attack vector	Local
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	1.4% (top 28%)
CISA exploited list	No
Weakness	CWE-787
Published	2023-02-28
Last modified	2026-06-17

Publisher (CNA): CERT/CC · Vendor: microsoft · trustedcomputinggroup

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-02-28 19:15 UTCPublished CVE record published
2026-06-17 05:26 UTCUpdated Record last modified

trustedcomputinggroup trusted platform module DOWNGRADE

Affected: 2.0 revision_1.16 · 2.0 revision_1.38 · 2.0 revision_1.59

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.0

1. Check installed version

apt-cache policy trusted-platform-module || rpm -q trusted-platform-module || trusted-platform-module --version

2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)

apt-cache madison trusted-platform-module sudo apt install trusted-platform-module=<VERSION_BEFORE_2.0> sudo apt-mark hold trusted-platform-module

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list trusted-platform-module sudo dnf downgrade trusted-platform-module-<VERSION_BEFORE_2.0> sudo dnf versionlock add trusted-platform-module

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

microsoft windows 10 1507 UPGRADE

Affected: < 10.0.10240.19805

Fixed in: 10.0.10240.19805

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

microsoft windows 10 1607 UPGRADE

Affected: < 10.0.14393.5786

Fixed in: 10.0.14393.5786

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

microsoft windows 10 1809 UPGRADE

Affected: < 10.0.17763.4131

Fixed in: 10.0.17763.4131

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

microsoft windows 10 20h2 UPGRADE

Affected: < 10.0.19042.2728

Fixed in: 10.0.19042.2728

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

microsoft windows 10 21h2 UPGRADE

Affected: < 10.0.19044.2728

Fixed in: 10.0.19044.2728

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-1017?

trusted platform module: downgrade or apply the listed mitigation; windows 10 1507: upgrade to 10.0.10240.19805; windows 10 1607: upgrade to 10.0.14393.5786. Exact commands for each OS are on this page.

Is CVE-2023-1017 being exploited?

CVE-2023-1017 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-1017 affect?

CVE-2023-1017 affects trusted platform module, windows 10 1507, windows 10 1607. Severity is high (CVSS 7.8). An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can

How urgent is CVE-2023-1017?

Priority 50/100. High severity; On your watchlist

Software pages

Windows vulnerabilities

Related CVEs

CVE-2023-1018 MEDIUM 5.5 DOWNGRADE UPGRADE An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a

References

← Back to latest CVEs