🟠 High | Source: GCP Compute Engine Security Bulletins
Two vulnerabilities (CVE-2023-1017 and CVE-2023-1018) were discovered in the Trusted Platform Module (TPM) 2.0 implementation affecting certain Google Compute Engine VMs. The flaws could allow a local attacker to trigger a denial-of-service, execute arbitrary code within the virtual TPM context, or leak sensitive information via an out-of-bounds read. Google automatically patched all affected VMs, requiring no action from customers.
Security Architect’s Take: No immediate action is required as Google has already auto-remediated affected VMs, but architects should review their reliance on vTPM for security guarantees and ensure that Shielded VM configurations are audited regularly. This incident highlights the importance of monitoring GCP security bulletins and validating that automatic patching mechanisms are functioning correctly across your VM fleet.
Original advisory: GCP-2023-004