Use of Hard-coded Cryptographic Key in tpm2-tools - CVE-2021-3565

Vulnerability identifier: #VU54287

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3565

CWE-ID: CWE-321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to usage of a fixed AES key in the tpm2_import function. A remote attacker can perform MitM attack and gain access to sensitive information.

tpm2-tools
Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Module for Basesystem
openEuler
Fedora
tpm2-tools (Red Hat package)
tpm2.0-tools
tpm2.0-tools-debuginfo
tpm2.0-tools-debugsource
tpm2-tools
tpm2-tools-debuginfo
tpm2-tools-debugsource
tpm2-tools-help

Install updates from vendor's website.

tpm2-tools - addressed in versions 4.3.2, 5.1.1
tpm2-tools (Red Hat package) - update to 4.1.1-5.el8
tpm2.0-tools - addressed in versions 4.1-3.3.1, 4.3.0-4.3.1
tpm2.0-tools-debuginfo - addressed in versions 4.1-3.3.1, 4.3.0-4.3.1
tpm2.0-tools-debugsource - addressed in versions 4.1-3.3.1, 4.3.0-4.3.1
tpm2-tools - addressed in versions 4.3.2-1.fc33, 5.1.1-1.fc34
tpm2-tools - update to 5.0-3
tpm2-tools-debuginfo - update to 5.0-3
tpm2-tools-debugsource - update to 5.0-3
tpm2-tools-help - update to 5.0-3

• https://bugzilla.redhat.com/show_bug.cgi?id=1964427
• https://github.com/tpm2-software/tpm2-tools/releases/tag/4.3.2
• https://github.com/tpm2-software/tpm2-tools/releases/tag/5.1.1

• Hardcoded AES key in tpm2-tools
• Arch Linux update for tpm2-tools
• Red Hat Enterprise Linux 8 update for tpm2-tools
• SUSE update for tpm2.0-tools
• SUSE update for tpm2.0-tools
• openEuler update for tpm2-tools
• Fedora 34 update for tpm2-tools
• Fedora 33 update for tpm2-tools