PSA-2025-00010-1: libtpms0/swtpm out of bounds read vulnerability

Bernd. said:
I'm missing information about what steps are needed after updating libtpms0. Is a host and/or VM restart necessary?
Click to expand...
You probably need to restart at least the affected VMs for this change to be effective.
 
I'm not a big fan of 'probably'. I much more prefer 'definitely'. ;)
So bad news for the Windows-Admins (currently the only VMs with a TPM state). But then they are already used to frequently reboot Windows, I've been told.
 
As far as I understand it, it is a linked library of the process that runs the VMs. So it will be loaded at runtime. To my understanding this means, yes you will need to re-start the VM process.

Or in other words, restarting the VMs that use TPMs need to restart at least those VMs.
 
either a cold start (if you can live with downtime), or a live migration to another node (if you can't) - both should ensure a new instance of swtpm (which loads fixed version of the library) is started together with the new instance of the VM.
 
  • Like
Reactions: Neobin and sterzy
You must log in or register to reply here.
Top Bottom