CVE-2017-16837

7.8 highEPSS 0.4%

Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not validated and can cause arbitrary code execution, which allows local users to overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking these function pointers.

Severity

CVSS 3.0

7.8 high

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-11-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

trusted_boot_project:trusted_boot

References

https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e/
https://www.usenix.org/conference/usenixsecurity18/presentation/han
https://sourceforge.net/p/tboot/code/ci/521c58e51eb5be105a29983742850e72c44ed80e/
https://www.usenix.org/conference/usenixsecurity18/presentation/han

Check your stack JSON