# CVE-2017-16837: tboot: Certain function pointers in Trusted Boot (tboot) through 1.9.6 are notvalidated and can cause arbitrary code executi...

CVE-2017-16837 is fixed in tboot on 1 platform, first by tboot 1.9.7-0ubuntu1, released November 15, 2017. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2017-16837
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0041
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 15, 2017

## Description

Certain function pointers in Trusted Boot (tboot) through 1.9.6 are notvalidated and can cause arbitrary code execution, which allows local usersto overwrite dynamic PCRs of Trusted Platform Module (TPM) by hooking thesefunction pointers.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | tboot Ubuntu 20.04 LTS (focal) | 1.9.7-0ubuntu1 | [tboot 1.9.7-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-tboot-1.9.7-0ubuntu1.md) | Nov 15, 2017 |
| Linux | tboot Ubuntu 24.10 (oracular) | 1.9.7-0ubuntu1 | [tboot 1.9.7-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-tboot-1.9.7-0ubuntu1.md) | Jan 16, 2026 |
| Linux | tboot Ubuntu 25.04 (plucky) | 1.9.7-0ubuntu1 | [tboot 1.9.7-0ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-tboot-1.9.7-0ubuntu1.md) | Jan 16, 2026 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo