PT-2024-24606 · Tillitis · Tillitis Tkey Signer Device Application

Volokitinss · Published 2024-04-23 · Updated 2024-04-24 · CVE-2024-32482

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tillitis TKey signer device application versions prior to 1.0.0

Description A vulnerability has been found in the Tillitis TKey signer device application, an ed25519 signing tool, which makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability, an attacker needs to use a custom client application and touch the TKey. No secret is disclosed.

Recommendations For versions prior to 1.0.0, upgrade to version 1.0.0 to receive a fix. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Out of bounds Read

Time Of Check To Time Of Use

Weakness Enumeration

CWE-125

CWE-367

Related Identifiers

CVE-2024-32482

GHSA-FRQC-62HV-379P

Affected Products

Tillitis Tkey Signer Device Application

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32482.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32482 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32482 · Vendor Advisory
• https://github.com/tillitis/tkey-device-signer/security/advisories/GHSA-frqc-62hv-379p · Note
• https://twitter.com/CVEnew/status/1782826996822864372 · Twitter Post
• https://t.me/cvenotify/77809 · Telegram Post
• https://bugbounty.tillitis.se/security-bulletins/tillitis-security-bulletin-240115-1 · Note
• https://twitter.com/VulmonFeeds/status/1782870935101423999 · Twitter Post