Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.
The product does not initialize a critical resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tpm2_software_stack | Tpm2_software_stack_project | * | 2.4.3 (excluding) |
| Tpm2_software_stack | Tpm2_software_stack_project | 3.0.0 (including) | 3.0.1 (excluding) |
| Tpm2-tss | Ubuntu | trusty | * |
| Tpm2-tss | Ubuntu | upstream | * |