Vulnerability Name:

CVE-2021-3505 (CCN-200459)

Assigned:2021-04-17
Published:2021-04-17
Updated:2021-06-03
Summary:A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.
CVSS v3 Severity:5.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
4.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
6.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
4.9 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-331
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2021-3505

Source: CCN
Type: Red Hat Bugzilla - Bug 1950046
(CVE-2021-3505) - CVE-2021-3505 libtpms: RSA keys weaker than expected

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1950046

Source: XF
Type: UNKNOWN
libtpms-cve20213505-info-disc(200459)

Source: CCN
Type: libtpms GIT Repository
[libtpms 0.7] TPM2_CreatePrimary creates prime numbers with 32 zero bits #183

Source: MISC
Type: Exploit, Patch, Third Party Advisory
https://github.com/stefanberger/libtpms/issues/183

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2021-cfdc434610

Vulnerable Configuration:Configuration 1:
  • cpe:/a:libtpms_project:libtpms:*:*:*:*:*:*:*:* (Version < 0.8.0)

    • Configuration 2:
  • cpe:/o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*

    • Configuration 3:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:602
    P
    		Security update for mariadb (Important)
    2022-07-27
    oval:org.opensuse.security:def:3501
    P
    		glib2-lang-2.48.2-12.15.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95131
    P
    		libtpms-devel-0.8.2-3.3.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:112879
    P
    		libtpms-devel-0.8.4-2.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106339
    P
    		libtpms-devel-0.8.4-2.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:2263
    P
    		libtpms-devel-0.8.2-1.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63352
    P
    		libtpms-devel-0.8.2-1.1 on GA media (Moderate)
    2021-08-10
    BACK
    libtpms_project libtpms *
    redhat enterprise linux 8.0
    fedoraproject fedora 33