CVE-2021-3446: Medium severity Libtpms Project Libtpms vulnerability
A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.
Other sources
The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller. The fix for this required the copying of the last-used IV from OpenSSL so it can be return back to the caller and used in subsequent encryption and decryption steps. The side-effect of the fix is that previously chain-encrypted data will not be decryptable anymore with the TPM 2.
Reference and upstream patch: https://github.com/stefanberger/libtpms/commit/32c159ab53db703749a8f90430cdc7b20b00975e
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libtpmsto a version that resolves this vulnerability.Fixed in 0.7.7 - Upgrade
Upgrade
redhat/libtpmsto a version that resolves this vulnerability.Fixed in 0.8.2 - Upgrade
Upgrade
libtpmsto a version that resolves this vulnerability.Fixed in 0.8.2 - Compensating control
If you used chain-encrypted data that relied on the buggy returned IV behavior, note the side-effect: previously chain-encrypted data will not be decryptable anymore with the TPM 2 after applying the fix.
Event History
Frequently Asked Questions
What is CVE-2021-3446?
CVE-2021-3446 is a vulnerability found in libtpms in versions before 0.8.2.
How does CVE-2021-3446 affect software?
CVE-2021-3446 affects Libtpms Project Libtpms, Redhat Enterprise Linux 8.0, and Fedoraproject Fedora 33.
What is the severity of CVE-2021-3446?
CVE-2021-3446 has a severity rating of medium, with a value of 5.5.
What is the Common Weakness Enumeration (CWE) for CVE-2021-3446?
The CWEs associated with CVE-2021-3446 are CWE-330 and CWE-327.
Where can I find more information about CVE-2021-3446?
More information about CVE-2021-3446 can be found at https://bugzilla.redhat.com/show_bug.cgi?id=1939664.