CVE:CVE-2022-23645
CNNVD:CNNVD-202202-1629
Stefanberger Swtpm是Stefanberger个人开发者的一个基于Libtpms的软件模拟器。该软件支持套接字，字符设备和Linux CUSE接口等功能。
Stefanberger Swtpm 0.5.3之前版本, 0.6.2之前版本, 和0.7.1之前版本存在缓冲区错误漏洞，攻击者可利用该漏洞通过精心编制的swtpm状态标头（blobheader的hdrsize指示符具有无效值）导致越界访问，引起系统崩溃或阻止其启动。
solution:Upgrade swtpm_project swtpm to a higher version than 0.5.3,0.6.2,0.7.0,0.7.0:rc1,0.7.0:rc2,and avoid the version (,0.5.3),[0.6.0,0.6.2),0.7.0,0.7.0:rc1,0.7.0:rc2; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade fedoraproject fedora to a higher version than 35,and avoid the version 35