CVE-2017-16837
tboot: Certain function pointers in Trusted Boot (tboot) through 1.9.6 are notvalidated and can cause arbitrary code executi...
CVE-2017-16837 is fixed in tboot on 1 platform, first by tboot 1.9.7-0ubuntu1, released November 15, 2017. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0041
35th percentile
Certain function pointers in Trusted Boot (tboot) through 1.9.6 are notvalidated and can cause arbitrary code execution, which allows local usersto overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking thesefunction pointers.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| tboot · Ubuntu 20.04 LTS (focal) | 1.9.7-0ubuntu1 | tboot 1.9.7-0ubuntu1 | Nov 15, 2017 |
| tboot · Ubuntu 24.10 (oracular) | 1.9.7-0ubuntu1 | tboot 1.9.7-0ubuntu1 | Jan 16, 2026 |
| tboot · Ubuntu 25.04 (plucky) | 1.9.7-0ubuntu1 | tboot 1.9.7-0ubuntu1 | Jan 16, 2026 |