PT-2021-11108 · Nuvoton · Nuvoton Trusted Platform Module

Antonin Dufka + 2 · Published 2021-08-10 · Updated 2021-08-17 · CVE-2020-25082

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AC:H/AV:P/A:N/C:H/I:N/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: Nuvoton Trusted Platform Module (NPCT75x) versions 7.2.x before 7.2.2.0

Description: An attacker with physical access could extract an Elliptic Curve Cryptography (ECC) private key via a side-channel attack against ECDSA, because of an Observable Timing Discrepancy. This issue affects the ECDSA implementation due to an observable timing discrepancy, allowing an attacker to potentially extract sensitive information.

Recommendations: For Nuvoton Trusted Platform Module (NPCT75x) versions 7.2.x before 7.2.2.0, update to version 7.2.2.0 or later to resolve the issue. As a temporary workaround, consider restricting physical access to the module to minimize the risk of exploitation.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2020-25082

Affected Products

Nuvoton Trusted Platform Module

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-25082 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25082 · Vendor Advisory
• https://nuvoton.com/support/product-related-information/security-advisories/sa-002 · Vendor Advisory
• https://t.me/cibsecurity/27086 · Telegram Post