medium
5.9
Advisory Published
Updated

CVE-2017-15361

First published: Mon Oct 16 2017(Updated: )

The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Infineon Trusted Platform Firmware=4.31
Infineon Trusted Platform Firmware=4.32
Infineon Trusted Platform Firmware=6.40
Infineon Trusted Platform Firmware=133.32
Acer C720 Chromebook
Acer Chromebase
Acer Chromebase 24
Acer Chromebook 11 C730
Acer Chromebook 11 C730e
Acer Chromebook 11 C735
Acer Chromebook 11 C740
Acer Chromebook 11 C771
Acer Chromebook 11 C771t
Acer Chromebook 11 N7 C731
Acer Chromebook 13 Cb5-311
Acer Chromebook 14 Cb3-431
Acer Chromebook 14 For Work Cp5-471
Acer Chromebook 15 Cb3-531
Acer Chromebook 15 Cb3-532
Acer Chromebook 15 Cb5-571
Acer Chromebook R11
Acer Chromebook R13 Cb5-312t
Acer Chromebox
Acer Chromebox Cxi2
Aopen Chromebase
Aopen Chromebase
Aopen Chromebox
Aopen Chromeboxi
Asi Chromebook
Asus Chromebit Cs10
Asus Chromebook C200
Asus Chromebook C201pa
Asus Chromebook C202sa
Asus Chromebook C300
Asus Chromebook C300sa
Asus Chromebook C301sa
Asus Chromebook Flip C100pa
Asus Chromebook Flip C302
Asus Chromebox Cn60
Asus Chromebox Cn62
Bobicus Chromebook 11
Ctl J2 Chromebook
Ctl J4 Chromebook
Ctl J5 Chromebook
Ctl N6 Chromebook
Ctl Nl61 Chromebook
Dell Chromebook 11
Dell Chromebook 11 3120
Dell Chromebook 11 3189
Dell Chromebook 11 Model 3180
Dell Chromebook 13 3380
Dell Chromebox
Edugear Chromebook K
Edugear Chromebook M
Edugear Chromebook R
Edugear Cmt Chromebook
Edxis Chromebook
Edxis Education Chromebook
Epik Chromebook Elb1101
Google Pixel
Haier Chromebook 11
Haier Chromebook 11 C
Haier Chromebook 11 G2
Haier Chromebook 11e
Hexa Chromebook Pi
Hisense Chromebook 11
Hp Chromebook
Hp Chromebook 11-vxxx
Hp Chromebook 11 1100-1199
Hp Chromebook 11 2000-2099
Hp Chromebook 11 2100-2199
Hp Chromebook 11 2200-2299
Hp Chromebook 11 G1
Hp Chromebook 11 G2
Hp Chromebook 11 G3
Hp Chromebook 11 G4\/g4 Ee
Hp Chromebook 11 G5
Hp Chromebook 11 G5 Ee
Hp Chromebook 13 G1
Hp Chromebook 14
Hp Chromebook 14 Ak000-099
Hp Chromebook 14 G3
Hp Chromebook 14 G4
Hp Chromebook 14 X000-x999
Hp Chromebox Cb1-\(000-099\)
Hp Chromebox G1
Lenovo 100s Chromebook
Lenovo N20 Chromebook
Lenovo N21 Chromebook
Lenovo N22 Chromebook
Lenovo N23 Chromebook
Lenovo N23 Flex 11 Chromebook
Lenovo N23 Yoga 11 Chromebook
Lenovo N42 Chromebook
Lenovo Thinkcentre Chromebox
Lenovo Thinkpad 11e Chromebook
Lenovo Thinkpad 13 Chromebook
Lg Chromebase 22cb25s
Lg Chromebase 22cv241
Medion Akoya S2013
Medion Chromebook S2015
Mercer Chromebook
Mercer V2 Chromebook
Ncomputing Chromebook Cx100
Nexian Chromebook
Pcmerge Chromebook Pcm-116t-432b
Poin2 Chromebook 11
Poin2 Chromebook 14
Positivo Chromebook Ch1190
Prowise Entry Line Chromebook
Prowise Proline Chromebook
Rgs Education Chromebook
Samsung Chromebook 2 11
Samsung Chromebook 2 11 Xe500c12
Samsung Chromebook 2 13
Samsung Chromebook 3
Samsung Chromebook Plus
Samsung Chromebook Pro
Sector-five E1 Rugged Chromebook
Senkatel C1101 Chromebook
Toshiba Chromebook
Toshiba Chromebook 2
Toshiba Chromebook 2
True Idc Chromebook
True Idc Chromebook 11
Videonet Chromebook
Videonet Chromebook Bl10
Viglen Chromebook 11
Viglen Chromebook 360
Xolo Chromebook
Infineon RSA library<=1.02.013

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2017-15361?

    The severity of CVE-2017-15361 is rated as medium with a score of 5.9.

  • How do I fix CVE-2017-15361?

    To fix CVE-2017-15361, update to a patched version of the Infineon RSA library, ideally version 1.02.014 or higher.

  • Which Infineon Trusted Platform Module (TPM) firmware versions are affected by CVE-2017-15361?

    CVE-2017-15361 affects Infineon Trusted Platform Module firmware versions before 0000000000000422 - 4.34, 000000000000062b - 6.43, and 0000000000008521 - 133.33.

  • What type of vulnerability is CVE-2017-15361?

    CVE-2017-15361 is an RSA key generation mishandling vulnerability in the Infineon RSA library.

  • Who is affected by CVE-2017-15361?

    Users of Infineon Trusted Platform Module firmware and devices using the Infineon RSA library are affected by CVE-2017-15361.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203