TCG TPM2.0 RefImpl OOB Read in CryptHmacSign (before v1.83)
CVE-2025-2884 Published on June 10, 2025

Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0

NVD

Vulnerability Analysis

CVE-2025-2884 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a high impact on availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

HIGH

Weakness Type

Out-of-bounds Read

The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.

Products Associated with CVE-2025-2884

Want to know whenever a new CVE is published for Siemens Simatic Cn 4100? stack.watch will email you.

Siemens Simatic Cn 4100

Affected Versions

Trusted Computing Group TPM2.0:

Before 1.83 is affected.

Siemens SIMATIC CN 4100:

Before * is affected.

Siemens SIMATIC Field PG M5:

Before * is affected.

Siemens SIMATIC Field PG M6:

Before * is affected.

Siemens SIMATIC IPC BX-32A:

Before V29.01.09 is affected.

Siemens SIMATIC IPC BX-39A:

Before V29.01.09 is affected.

Siemens SIMATIC IPC BX-56A:

Before V32.01.09 is affected.

Siemens SIMATIC IPC BX-59A:

Before V32.01.09 is affected.

Siemens SIMATIC IPC MD-57A:

Before V30.01.10 is affected.

Siemens SIMATIC IPC PX-32A:

Before V29.01.09 is affected.

Siemens SIMATIC IPC PX-39A:

Before V29.01.09 is affected.

Siemens SIMATIC IPC PX-39A PRO:

Before V29.01.09 is affected.

Siemens SIMATIC IPC RW-528A:

Before V34.01.02 is affected.

Siemens SIMATIC IPC RW-548A:

Before V34.01.02 is affected.

Siemens SIMATIC IPC227E:

Before * is affected.

Siemens SIMATIC IPC277E:

Before * is affected.

Siemens SIMATIC IPC427E:

Before V21.01.20 is affected.

Siemens SIMATIC IPC477E:

Before V21.01.20 is affected.

Siemens SIMATIC IPC477E PRO:

Before V21.01.20 is affected.

Siemens SIMATIC IPC627E:

Before * is affected.

Siemens SIMATIC IPC647E:

Before * is affected.

Siemens SIMATIC IPC677E:

Before * is affected.

Siemens SIMATIC IPC847E:

Before * is affected.

Siemens SIMATIC ITP1000:

Before * is affected.

Siemens SIPLUS IPC427E:

Before V21.01.20 is affected.

Exploit Probability

EPSS

0.07%

Percentile

21.62%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.