Medium severity6.6NVD Advisory· Published Jun 10, 2025· Updated Apr 15, 2026
CVE-2025-2884
CVE-2025-2884
Description
TCG TPM2.0 Reference implementation's CryptHmacSign helper function is vulnerable to Out-of-Bounds read due to the lack of validation the signature scheme with the signature key's algorithm. See Errata Revision 1.83 and advisory TCGVRT0009 for TCG standard TPM2.0
Patches
104b2d8e9afc0Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8- cert-portal.siemens.com/productcert/html/ssa-628843.htmlnvd
- github.com/stefanberger/libtpms/commit/04b2d8e9afc0a9b6bffe562a23e58c0de11532d1nvd
- trustedcomputinggroup.org/about/security/nvd
- trustedcomputinggroup.org/wp-content/uploads/TPM2.0-Library-Spec-v1.83-Errata_v1_pub.pdfnvd
- trustedcomputinggroup.org/wp-content/uploads/VRT0009-Advisory-FINAL.pdfnvd
- www.cve.org/CVERecordnvd
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01209.htmlnvd
- www.kb.cert.org/vuls/id/282450nvd
News mentions
1- Siemens TPM 2.0CISA Alerts