CVE-2025-71077: Linux Kernel TPM Privilege Escalation

CVE-2025-71077 Overview

A boundary condition error vulnerability has been identified in the Linux kernel's Trusted Platform Module (TPM) subsystem. The tpm2_get_pcr_allocation() function fails to enforce an upper limit on the number of PCR (Platform Configuration Register) banks, potentially allowing out-of-bounds values from external I/O to cause memory corruption or other undefined behavior.

Critical Impact

Malformed TPM responses containing excessive PCR bank counts could lead to memory corruption, denial of service, or potentially other security impacts in affected Linux kernel versions.

Affected Products

• Linux kernel (versions prior to the security patch)
• Systems utilizing TPM 2.0 hardware with affected kernel versions
• Enterprise and embedded Linux distributions with vulnerable kernel builds

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-71077 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-71077

Vulnerability Analysis

This vulnerability exists in the TPM driver subsystem of the Linux kernel, specifically within the PCR allocation retrieval mechanism. The tpm2_get_pcr_allocation() function is responsible for querying and processing the number of PCR banks available on a TPM 2.0 device. However, the function does not validate or cap the number of banks reported by the TPM hardware.

When interacting with TPM hardware, the kernel receives data via external I/O operations. If a malicious or malfunctioning TPM device reports an excessively large number of PCR banks, the kernel would attempt to process this value without proper bounds checking. This could result in memory access beyond allocated buffers, leading to potential memory corruption, kernel crashes, or other undefined behavior.

The fix introduces a cap of eight PCR banks, which represents a reasonable upper limit for legitimate TPM implementations while preventing out-of-bounds conditions from causing significant harm.

Root Cause

The root cause is missing input validation in the tpm2_get_pcr_allocation() function. The function accepts the PCR bank count value directly from external I/O without verifying that it falls within expected bounds. This violates the security principle of never trusting external input, even from hardware interfaces that are typically considered trusted.

Attack Vector

The attack vector involves providing malformed TPM responses that contain exaggerated PCR bank count values. While practical exploitation would typically require either:

1. A compromised or malicious TPM device
2. The ability to intercept and modify TPM communication
3. A virtualized TPM that can be manipulated by the hypervisor

The fix addresses this by capping the maximum number of PCR banks at eight, ensuring that even if malformed data is received, the impact is limited and controlled. This defensive programming approach prevents potential buffer overflows or other memory safety issues that could arise from unbounded iteration or allocation based on the unchecked value.

Detection Methods for CVE-2025-71077

Indicators of Compromise

• Unusual kernel crashes or panics in TPM-related code paths
• Unexpected memory corruption errors in systems utilizing TPM functionality
• Anomalous TPM driver behavior or error messages in kernel logs

Detection Strategies

• Monitor kernel logs for TPM subsystem errors using dmesg | grep -i tpm
• Deploy kernel-level monitoring to detect anomalous TPM driver activity
• Implement integrity monitoring on TPM-related kernel modules
• Review system logs for unexpected PCR bank enumeration failures

Monitoring Recommendations

• Enable kernel audit logging for TPM-related system calls and operations
• Configure system monitoring to alert on kernel panics or oops involving TPM drivers
• Implement continuous vulnerability scanning to identify unpatched kernel versions
• Monitor for unusual TPM device behavior in virtualized environments

How to Mitigate CVE-2025-71077

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Review systems utilizing TPM 2.0 functionality for signs of exploitation
• Prioritize patching systems in security-critical environments
• Consider temporarily disabling TPM functionality if patching is not immediately possible

Patch Information

The vulnerability has been addressed through multiple kernel commits that cap the number of PCR banks to eight. The patches are available in the stable kernel branches:

• Kernel Git Commit 858344b
• Kernel Git Commit b694921
• Kernel Git Commit ceb70d3
• Kernel Git Commit d884816
• Kernel Git Commit faf07e6

Organizations should apply these patches through their standard kernel update procedures or distribution security updates.

Workarounds

• If patching is not immediately feasible, consider disabling TPM functionality by blacklisting the TPM kernel modules
• Restrict physical access to systems to prevent TPM device tampering
• In virtualized environments, ensure TPM emulation is properly configured and secured
• Monitor for vendor-specific kernel updates from your Linux distribution

# Temporarily disable TPM kernel modules (workaround only)
echo "blacklist tpm" >> /etc/modprobe.d/tpm-disable.conf
echo "blacklist tpm_tis" >> /etc/modprobe.d/tpm-disable.conf
echo "blacklist tpm_crb" >> /etc/modprobe.d/tpm-disable.conf

# Verify TPM modules are not loaded
lsmod | grep tpm

# After patching, remove the blacklist and reload modules
# rm /etc/modprobe.d/tpm-disable.conf
# modprobe tpm_tis