PT-2020-16558 · Trusted Computing · Trusted Platform Module Library Family 2.0

Published 2020-11-18 · Updated 2020-12-07 · CVE-2020-26933

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AC:H/AV:L/A:N/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59

Description The issue is related to Incorrect Access Control during a non-orderly TPM shut-down that uses USE DA USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack.

Recommendations For Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59, consider implementing proper initialization of the non-orderly TPM shut-down to prevent susceptibility to dictionary attacks. As a temporary workaround, consider restricting the use of USE DA USED until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2020-26933

Affected Products

Trusted Platform Module Library Family 2.0

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-26933 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26933 · Vendor Advisory
• https://trustedcomputinggroup.org/about/security · Vendor Advisory
• https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf · Vendor Advisory
• https://t.me/cvenotify/5771 · Telegram Post
• https://t.me/cibsecurity/16534 · Telegram Post