CVE-2025-1122

MEDIUM

6.7

Description

Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.

CVE Details

CVSS v3.1 Score6.7

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published4/15/2025

Last Modified10/6/2025

Sourcenvd

Honeypot Sightings0

Affected Products

google:chromegoogle:chrome_os

Weaknesses (CWE)

CWE-787

References

https://issues.chromium.org/issues/b/324336238(7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f)

https://issuetracker.google.com/issues/324336238(7f6e188d-c52a-4a19-8674-3c3fa7d1fc7f)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.