What’s Vulnerable › Vulnerabilities

CVE-2017-16837

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-11-16 · updated 2026-06-17
• Weakness: CWE-20

Description

Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.

Affected products

• Trusted Boot Project Trusted Boot: 1.9.6

References

• https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e/
• https://www.usenix.org/conference/usenixsecurity18/presentation/han
• https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e/
• https://www.usenix.org/conference/usenixsecurity18/presentation/han

Get alerted when CVE-2017-16837 or the next vulnerability affects your stack