tss-esapi

Version	Released
`8.0.0-alpha.3` pre	Aug 24, 2026
`7.7.0` unknown	Apr 24, 2026
`8.0.0-alpha.2` unknown	Feb 26, 2026
`8.0.0-alpha.1` unknown	Oct 25, 2025
`7.6.0` unknown	Dec 14, 2024
`7.5.1` unknown	Apr 16, 2024
`7.5.0` unknown	Mar 14, 2024
`8.0.0-alpha` unknown	Feb 07, 2024
`7.4.0` unknown	Oct 09, 2023
`7.3.0` unknown	Sep 20, 2023
`7.2.0` unknown	Feb 06, 2023
`7.1.0` unknown	May 25, 2022
`6.1.2` unknown	May 25, 2022
`7.0.1` unknown 1 CVE	Mar 21, 2022
`7.0.0` unknown 1 CVE	Feb 15, 2022
`7.0.0-beta.2` unknown	Feb 08, 2022
`7.0.0-beta.1` unknown	Feb 04, 2022
`6.1.1` unknown 1 CVE	Sep 29, 2021
`7.0.0-alpha.1` unknown	Sep 17, 2021
`6.1.0` unknown 1 CVE	Aug 05, 2021
`6.0.0` unknown 1 CVE	Aug 04, 2021
`5.1.0` unknown 1 CVE	Jun 17, 2021
`5.0.1` unknown 1 CVE	Mar 25, 2021
`5.0.0` unknown 1 CVE	Mar 23, 2021
`4.0.10-alpha.2` unknown 1 CVE	Dec 17, 2020
`4.0.10-alpha.1` unknown 1 CVE	Nov 24, 2020
`4.0.9-alpha.1` unknown 1 CVE	Sep 07, 2020
`4.0.8-alpha.1` unknown 1 CVE	Aug 13, 2020
`4.0.7-alpha.1` unknown 1 CVE	Aug 13, 2020
`4.0.6-alpha.1` unknown 1 CVE	Aug 03, 2020
`4.0.5-alpha.1` unknown 1 CVE	Jul 02, 2020
`4.0.4-alpha.1` unknown 1 CVE	Jun 17, 2020
`4.0.3-alpha.1` unknown 1 CVE	Jun 03, 2020
`4.0.2-alpha.1` unknown 1 CVE	May 11, 2020
`4.0.1-alpha.1` unknown 1 CVE	May 06, 2020
`4.0.0-alpha.1` unknown 1 CVE	May 04, 2020
`3.0.2` unknown 1 CVE	Mar 20, 2020
`3.0.1` unknown 1 CVE	Mar 11, 2020
`3.0.0` unknown 1 CVE	Mar 10, 2020
`2.0.0` unknown 1 CVE	Jan 27, 2020
`1.0.1` unknown 1 CVE	Jan 17, 2020
`1.0.0` unknown 1 CVE	Jan 15, 2020

8.0.0-alpha.3 pre

Aug 24, 2026

7.7.0 unknown

Apr 24, 2026

8.0.0-alpha.2 unknown

Feb 26, 2026

8.0.0-alpha.1 unknown

Oct 25, 2025

7.6.0 unknown

Dec 14, 2024

7.5.1 unknown

Apr 16, 2024

7.5.0 unknown

Mar 14, 2024

8.0.0-alpha unknown

Feb 07, 2024

7.4.0 unknown

Oct 09, 2023

7.3.0 unknown

Sep 20, 2023

7.2.0 unknown

Feb 06, 2023

7.1.0 unknown

May 25, 2022

6.1.2 unknown

May 25, 2022

7.0.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 21, 2022

7.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Feb 15, 2022

7.0.0-beta.2 unknown

Feb 08, 2022

7.0.0-beta.1 unknown

Feb 04, 2022

6.1.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Sep 29, 2021

7.0.0-alpha.1 unknown

Sep 17, 2021

6.1.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Aug 05, 2021

6.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Aug 04, 2021

5.1.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jun 17, 2021

5.0.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 25, 2021

5.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 23, 2021

4.0.10-alpha.2 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Dec 17, 2020

4.0.10-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Nov 24, 2020

4.0.9-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Sep 07, 2020

4.0.8-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Aug 13, 2020

4.0.7-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Aug 13, 2020

4.0.6-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Aug 03, 2020

4.0.5-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jul 02, 2020

4.0.4-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jun 17, 2020

4.0.3-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jun 03, 2020

4.0.2-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

May 11, 2020

4.0.1-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

May 06, 2020

4.0.0-alpha.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

May 04, 2020

3.0.2 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 20, 2020

3.0.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 11, 2020

3.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Mar 10, 2020

2.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jan 27, 2020

1.0.1 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jan 17, 2020

1.0.0 unknown

1 CVE

GHSA-w3vw-ccc5-qr8v Jun 17, 2022

Use After Free in Context::start_auth_session

Medium

Impact

This issue only applies to applications starting authorization sessions using an explicit initial nonce.

When Context::start_auth_session was called with a nonce argument value of Some(...), the nonce pointer passed down through FFI to Esys_StartAuthSession would be a dangling pointer, left over from a defunct instance of TPM2B_NONCE. This could lead to an incorrect value being used as a nonce, though whether that value is controllable is unclear (so should be assumed as possible). The error became apparent due to changes in v1.61.0 of the Rust compiler.

Logs indicating a failure due to this issue (with the 1.61.0 version of the Rust toolchain) look as follows:

2022-05-24T01:04:41.9131341Z WARNING:esys:src/tss2-esys/api/Esys_StartAuthSession.c:390:Esys_StartAuthSession_Finish() Received TPM Error 
2022-05-24T01:04:41.9132192Z ERROR:esys:src/tss2-esys/api/Esys_StartAuthSession.c:136:Esys_StartAuthSession() Esys Finish ErrorCode (0x000001d5) 
2022-05-24T01:04:41.9145124Z [2022-05-24T01:04:41Z ERROR tss_esapi::context::tpm_commands::session_commands] Error when creating a session: structure is the wrong size (associated with parameter number 1)
2022-05-24T01:04:41.9153816Z thread 'main' panicked at 'Call to start_auth_session failed: Tss2Error(FormatOne(FormatOneResponseCode { .0: 469, error_number: 21, parameter: true, format_selector: true, number: 1 }))', tss-esapi/tests/integration_tests/context_tests/tpm_commands/enhanced_authorization_ea_commands_tests.rs:870:14

Patches

The issue has been patched in versions 6 and 7 of the tss-esapi crate. Please update to 7.1.0 or 6.1.2.

Workarounds

There is no workaround that achieves the same functionality.

References

For more information on the cause of the issue and the fix, see this PR.

For more details about the TPM2_StartAuthSession command see section 11.1 of the TPM spec, part 3, and section 19.6.3 of part 1 of the same spec for more information regarding session nonces.

For more information

If you have any questions or comments about this advisory:

Open an issue or discussion in our repo
Get in touch on our Slack channel

Fixed in


          6.1.2


          7.1.0

References

Updated Jun 17, 2022 · Source: OSV.dev

Jan 15, 2020

Activity

Reach

Details