CVE-2023-1017: TPM 2.0 Module Library RCE Vulnerability

CVE-2023-1017 Overview

CVE-2023-1017 is an out-of-bounds write vulnerability [CWE-787] in the Trusted Computing Group (TCG) TPM2.0 Module Library. The flaw resides in the CryptParameterDecryption routine, which permits writing two bytes of data past the end of a TPM2.0 command buffer. A local attacker with low privileges who can deliver crafted commands to the TPM can trigger denial of service by crashing the TPM chip or process. The same condition can lead to arbitrary code execution inside the TPM context, undermining the trust boundary the TPM is intended to enforce. The vulnerability affects Trusted Platform Module 2.0 revisions 1.16, 1.38, and 1.59, and downstream operating systems including multiple builds of Windows 10, Windows 11, and Windows Server.

Critical Impact
Successful exploitation breaks the TPM trust boundary, enabling code execution within the TPM context or persistent denial of service of the cryptographic root of trust.

Affected Products

Trusted Computing Group Trusted Platform Module 2.0 (revisions 1.16, 1.38, 1.59)
Microsoft Windows 10 (1507, 1607, 1809, 20H2, 21H2, 22H2) and Windows 11 (21H2, 22H2)
Microsoft Windows Server 2016, 2019, and 2022

Discovery Timeline

2023-02-28 - CVE-2023-1017 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-1017

Vulnerability Analysis

The TPM2.0 specification defines a Module Library that vendors implement to provide cryptographic services rooted in hardware. CVE-2023-1017 affects the parameter decryption path used when commands carry session-encrypted parameters. During processing, the CryptParameterDecryption routine writes two bytes beyond the end of the command buffer in TPM memory.

The TPM operates as a privileged isolated execution environment. Memory corruption inside this environment defeats the assurances the TPM provides to the host operating system, including measured boot, key sealing, and remote attestation. Exploitation requires only local access and low privileges, with no user interaction.

Root Cause

The root cause is missing bounds enforcement on the size of decrypted parameter data relative to the command buffer. The TPM2.0 Module Library trusts caller-supplied size fields without validating that the resulting write stays within the allocated buffer. Two bytes of attacker-controlled data are written past the buffer end, corrupting adjacent TPM memory structures.

Attack Vector

An attacker with the ability to issue TPM commands sends a crafted command containing a malformed encrypted parameter. When the TPM invokes CryptParameterDecryption, the out-of-bounds write corrupts memory adjacent to the command buffer. Depending on what data resides at that location, the attacker can crash the TPM (denial of service) or steer execution to attacker-controlled logic inside the TPM context. The local attack vector applies to any user-mode process or guest VM that can reach the TPM command interface.

No public proof-of-concept exploit code has been released. See the Trusted Computing Group Security Advisory and CERT Vulnerability ID #782720 for technical detail.

Detection Methods for CVE-2023-1017

Indicators of Compromise

Unexpected TPM service crashes, tpm.sys faults, or TPM_RC_FAILURE responses returned to user-mode callers on Windows hosts.
Event Log entries indicating TPM command failures, TPM resets outside of boot, or repeated failed TPM2_StartAuthSession and parameter-encrypted command sequences from non-administrative processes.
Unprivileged processes issuing high volumes of low-level TPM commands through TBS (TPM Base Services) APIs.

Detection Strategies

Monitor Windows Event Log channels Microsoft-Windows-TPM-WMI and System log for TPM error events and unexpected device resets.
Correlate process telemetry against TPM API usage to identify non-standard callers invoking session-based parameter encryption.
Track patch compliance for TPM firmware updates and Windows cumulative updates that address CVE-2023-1017 across the fleet.

Monitoring Recommendations

Inventory hosts running unpatched TPM 2.0 firmware revisions 1.16, 1.38, and 1.59, and prioritize remediation of systems exposing the TPM to multi-tenant or untrusted local workloads.
Alert on repeated TPM command failures originating from the same process or user session.
Audit virtualization platforms passing TPM access into guest VMs and review which guests can issue raw TPM commands.

How to Mitigate CVE-2023-1017

Immediate Actions Required

Apply the Microsoft security updates that ship the patched TPM2.0 library for affected Windows 10, Windows 11, and Windows Server builds.
Update firmware-TPM (fTPM) and discrete TPM (dTPM) implementations from OEM and silicon vendors that incorporate the upstream TCG fix.
Restrict local access on systems where TPM operations are exposed to low-privilege users or guest virtual machines.

Patch Information

The Trusted Computing Group released corrected TPM2.0 specification errata that fix the bounds check in CryptParameterDecryption. Refer to the Trusted Computing Group Security Advisory for the authoritative remediation guidance. Microsoft delivered fixes through Windows cumulative updates for the affected Windows 10, Windows 11, and Windows Server SKUs. OEMs ship firmware updates incorporating the corrected library for discrete and firmware-based TPM implementations.

Workarounds

Where patching is delayed, limit local logon and code execution rights to trusted administrative accounts to reduce the local attack surface.
For virtualized environments, disable virtual TPM passthrough to untrusted guests until host firmware is updated.
Disable TPM-dependent features that accept attacker-influenced parameter input only as a temporary measure, recognizing this may affect BitLocker, attestation, and measured boot dependencies.

bash

# Verify TPM status and specification version on Windows
Get-Tpm
Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm | Select SpecVersion, ManufacturerVersion

# Confirm latest Windows cumulative update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 5