DMTF libspdm - SPDM Requester timeout handling: A libspdm Requester stores the Responder's CTExponent

Impact

A libspdm Requester stores the Responder's CTExponent without validating it, so a malicious or faulty responder can force an enormous computed timeout and hang the requester. In an attestation flow this is a denial of service against the thing that decides whether a device is trustworthy - and a hung attestation is often failed open by the surrounding orchestration.

Who can reach it

Adjacent, unauthenticated with user interaction. A device on the link that answers CAPABILITIES dishonestly.

What to do

Update to libspdm 2.3.3 / 3.0 or later, again through your device vendor's firmware. Separately, check what your orchestration does when attestation times out rather than fails - failing open on timeout is the more damaging half of this.

References