CVE-2025-71077

Summary

In the Linux kernel, the following vulnerability has been resolved:

tpm: Cap the number of PCR banks

tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < 8ceee7288152bc121a6bf92997261838c78bfe06affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < 275c686f1e3cc056ec66c764489ec1fe1e51b950affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < ceb70d31da5671d298bad94ae6c20e4bbb800f96affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < d88481653d74d622d1d0d2c9bad845fc2cc6fd23affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < b69492161c056d36789aee42a87a33c18c8ed5e1affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < 858344bc9210bea9ab2bdc7e9e331ba84c164e50affected
LinuxLinuxbcfff8384f6c4e6627676ef07ccad9cfacd67849 < faf07e611dfa464b201223a7253e9dc5ee0f3c9eaffected
LinuxLinux5.1affected
LinuxLinux0 < 5.1unaffected
LinuxLinux5.10.248 <= 5.10.*unaffected
LinuxLinux5.15.198 <= 5.15.*unaffected
LinuxLinux6.1.160 <= 6.1.*unaffected
LinuxLinux6.6.120 <= 6.6.*unaffected
LinuxLinux6.12.64 <= 6.12.*unaffected
LinuxLinux6.18.3 <= 6.18.*unaffected
LinuxLinux6.19 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References