#VU54502 Insufficient Entropy in libtpms - CVE-2021-3505

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU54502

#VU54502 Insufficient Entropy in libtpms - CVE-2021-3505

Published: July 1, 2021


Vulnerability identifier: #VU54502
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2021-3505
CWE-ID: CWE-331
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
libtpms
Software vendor:
Stefan Berger

Description

The vulnerability allows a local user to decrypt data.

The vulnerability exists in the TPM 2 implementation, which returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check.


Remediation

Install updates from vendor's website.

External links