PT-2021-4260 · Unknown+5 · Tpm2-Tools+5

Guilherme De Almeida Suckevicz

·

Published

2021-05-26

·

Updated

2024-06-15

·

CVE-2021-3565

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions tpm2-tools versions prior to 5.1.1 tpm2-tools versions prior to 4.3.2
Description The issue is related to the use of a fixed AES key for internal wrapping in tpm2-tools, which could allow a remote attacker to access confidential data. Specifically, the tpm2 import function used a fixed AES key for the inner wrapper, potentially allowing a Man-In-The-Middle (MITM) attacker to unwrap the inner portion and reveal the key being imported. The highest threat from this issue is to data confidentiality.
Recommendations For versions prior to 5.1.1, update to version 5.1.1 or later to resolve the issue. For versions prior to 4.3.2, update to version 4.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the tpm2 import function until a patch is available.

Fix

Information Disclosure

Improper Initialization

Using Hardcoded Credentials

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

ALSA-2021:4413
AZL-6923
BDU:2021-04868
CESA-2021_4413
CVE-2021-3565
MGASA-2021-0353
OESA-2021-1384
OPENSUSE-SU-2021:0934-1
OPENSUSE-SU-2021:1998-1
OPENSUSE-SU-2021_0934-1
OPENSUSE-SU-2021_1998-1
OPENSUSE-SU-2024:11471-1
RHSA-2021:4413
RHSA-2021_4413
RLSA-2021:4413
SUSE-SU-2021:1998-1
SUSE-SU-2021:1999-1
SUSE-SU-2021_1998-1
SUSE-SU-2021_1999-1

Affected Products

Almalinux
Centos
Red Hat
Rocky Linux
Suse
Tpm2-Tools