Use of a broken or risky cryptographic algorithm in libtpms - CVE-2021-3446
Published: July 1, 2021
Vulnerability identifier: #VU54501
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3446
CWE-ID: CWE-327
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to decrypt data.
The vulnerability exists in libtpms due to integration with OpenSSL, which contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps.
Affected software
libtpms
Fedora
libtpms
Fedora
libtpms
How to mitigate CVE-2021-3446
Install updates from vendor's website.
libtpms - update to 0.8.2
libtpms - update to 0.8.2-0.20210301git729fc6a4ca.fc34.1
libtpms - update to 0.8.2-0.20210301git729fc6a4ca.fc34.1