BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.pass-the-salt.org//pts2023//talk//9ZDVHG
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-pts2023-9ZDVHG@cfp.pass-the-salt.org
DTSTART;TZID=CET:20230703T141500
DTEND;TZID=CET:20230703T145000
DESCRIPTION:Trusted Platform Module (TPM) is a standard for a secure crypto
 processor. TPMs come in different flavors: there are discrete chips\, inte
 grated TPMs\, firmware-based TPMs\, and virtual TPMs. They provide a numbe
 r of cryptographic features\, such as generation and secure storage of cry
 ptographic keys\, symmetric and asymmetric encryption/decryption\, digital
  signature generation/verification\, and random number generation. Typical
  use cases include attestation of the boot process integrity\, storage of 
 disk encryption keys\, and digital rights management.\n\nThe Trusted Compu
 ting Group (TCG)\, a nonprofit organization\, is in charge of publishing a
 nd maintaining the TPM standard. As such\, they provide a reference implem
 entation of the TPM 2.0 specification. While auditing this reference imple
 mentation code\, we discovered two vulnerabilities in the handling of encr
 ypted parameters: an out-of-bounds write and an out-of-bounds read\, which
  were assigned CVE-2023-1017 and CVE-2023-1018\, respectively. Given that 
 the bugs originate from the reference implementation\, these two vulnerabi
 lities propagated across multiple code bases and ended up affecting a wide
  range of vendors\, from chip manufacturers to virtualization solutions an
 d cloud computing providers. Among the impacted source trees we can mentio
 n the open source implementations of the TPM 2.0 standard published by Mic
 rosoft and IBM\, as well as libtpms\, an open source library providing sof
 tware emulation of a Trusted Platform Module\, which in turn is used by ot
 her free software projects\, such as QEMU and VirtualBox\, to provide a vi
 rtual TPM device for VMs.\n\nWe'll start this presentation by discussing h
 ow TPMs work\, implementation details of the different virtual TPMs\, and 
 the internals of the protocol used to send TPM 2.0 commands. Then we'll go
  over the specifics of the two vulnerabilities we discovered\, addressing 
 the affected products as well as the possibilities for exploitation. Final
 ly\, we'll conclude the talk with some highlights of the complex\, industr
 y-wide disclosure process we conducted\, in which numerous parties were in
 volved.
DTSTAMP:20260910T042308Z
LOCATION:Amphitheater
SUMMARY:Vulnerabilities in the TPM 2.0 reference implementation code - Fran
 cisco Falcon
URL:https://cfp.pass-the-salt.org/pts2023/talk/9ZDVHG/
END:VEVENT
END:VCALENDAR