VULNERABILITY INTELLIGENCE

CVE-2017-16837

CVSS score7.8 HIGH
EPSS probability0.41%
CISA KEVNot currently listed
Published2017-11-16
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references