Description
Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via local access. This affects tpm2-tss before 3.0.1 and before 2.4.3.
References (5)
Scores
CVSS v3
6.7
EPSS
0.0010
EPSS Percentile
27.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-909
Status
published
Products (2)
fedoraproject/fedora
34
tpm2_software_stack_project/tpm2_software_stack
< 2.4.3
Published
Feb 26, 2021
Tracked Since
Feb 18, 2026