tpm2-tss (Tss2_RC_Decode / Tss2_RC_SetHandler): An 8-bit layer number indexes an array with far fewer entries, so a TPM

Impact

An 8-bit layer number indexes an array with far fewer entries, so a TPM response code the library did not expect reads or writes outside the buffer - and the path to arbitrary code execution runs through the userspace component that every attestation and key-sealing tool on the node depends on. The disclosed trigger is a man-in-the-middle on the TPM bus returning 0xFFFFFFFF, which ties this directly to the physical-interposer threat model.

Who can reach it

Local, privileged - or an attacker sitting on the TPM's LPC/SPI bus, which is a hardware-interposer attack that a colo tenant or remote-hands contractor can mount.

What to do

Package update to tpm2-tss 4.0.1 / 3.2.2 or later and restart anything linked against it - no reboot, no firmware flash. One of the genuinely cheap fixes in this cluster, so there is no reason to carry it.

References