Skip to content
CVE PROGRAM SOURCE RECORD6.7 Medium

CVE-2025-1292

TPM2 Out-Of-Bounds Write Leading to Potential Operating System Verification Bypass in ChromeOS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ChromeOS

Description

Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Google ChromeOS

Default version status: unaffected

  • 122.0.6261.132affected

References