CVE-2023-1018

What it actually does

Out-of-bounds read in CryptParameterDecryption routine allows a 2-byte read past the end of a TPM2.0 command, exposing sensitive data stored in the TPM.

Why it matters to the business

Attackers with local access could extract sensitive data such as cryptographic keys from the Trusted Platform Module, undermining encryption, attestation, and boot security across many systems. Low and stable exploit likelihood reduces immediate urgency.

How an attack unfolds

An attacker with local privileges crafts a malicious TPM2.0 command that triggers an out-of-bounds read in the CryptParameterDecryption routine of the TPM2.0 Module Library, reading adjacent memory containing sensitive TPM data.

How to fix it

Apply vendor-supplied updates to TPM2.0 implementations and affected operating systems. Monitor Trusted Computing Group and Microsoft security bulletins for revised firmware or library releases addressing the bounds-checking flaw.

How to confirm the fix worked

Confirm TPM firmware, drivers, and Windows updates are current; retest TPM command handling to verify bounds checks prevent reads beyond command buffers.

Typical attack path

1. Obtain local access or low-privileged execution on the target system
2. Locate and interact with the TPM2.0 interface
3. Submit a specially crafted command that reaches CryptParameterDecryption
4. Read the two bytes of out-of-bounds memory containing TPM secrets

How to detect it

Inspect system and TPM driver logs for repeated or malformed command entries that coincide with unexpected memory access patterns; correlate with processes that interact directly with the TPM.

What your security team should do

• Apply available TPM and OS patches as soon as released
• Limit local user privileges on systems using TPM-protected features
• Review TPM event logs for anomalous command patterns