CVE-2023-22745: tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Modul

Routine

MEDIUM 6.4UPGRADE

CVE-2023-22745 is a medium-severity flaw (CVSS 6.4) affecting tpm2 software stack. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with s

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.4 (Medium)
Attack vector	Local
Attack complexity	High
Privileges needed	High
User interaction	None
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Weakness	CWE-120
Published	2023-01-19
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: tpm2 software stack project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-01-19 23:15 UTCPublished CVE record published
2026-06-17 05:36 UTCUpdated Record last modified

tpm2 software stack project tpm2 software stack UPGRADE

Affected: < 3.2.2 · >= 4.0.0 and < 4.1.0

Fixed in: 3.2.2, 4.1.0

Safe to downgrade to: a release before 4.0.0

1. Check installed version

apt-cache policy tpm2-software-stack || rpm -q tpm2-software-stack || tpm2-software-stack --version

2. UPGRADE to 3.2.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade tpm2-software-stack

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade tpm2-software-stack

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 4.0.0 (Debian / Ubuntu)

apt-cache madison tpm2-software-stack sudo apt install tpm2-software-stack=<VERSION_BEFORE_4.0.0> sudo apt-mark hold tpm2-software-stack

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tpm2-software-stack sudo dnf downgrade tpm2-software-stack-<VERSION_BEFORE_4.0.0> sudo dnf versionlock add tpm2-software-stack

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-22745?

tpm2 software stack: upgrade to 3.2.2, 4.1.0. Exact commands for each OS are on this page.

Is CVE-2023-22745 being exploited?

CVE-2023-22745 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-22745 affect?

CVE-2023-22745 affects tpm2 software stack. Severity is medium (CVSS 6.4). tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` b

How urgent is CVE-2023-22745?

Priority 38/100. Public exploit reference

References

← Back to latest CVEs