CVE-2021-3505: Medium severity Libtpms Project Libtpms vulnerability
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.
Other sources
The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TPM 2 key creation algorithm that cannot easily be fixed. The bug is in RsaAjustPrimeCandidate, which is called before the prime number check. Upgrading to a fixed release (0.8.0+) is not sufficient. The only way to fix it is to unseal all data, delete the old TPM state file, generate a new one, then reseal the data.
Note: the bug is based on the TCG reference code. The TCG specification was updated in late 2019 and libtpms' key creation algorithm fixed in version 0.8.0.
Upstream issue: https://github.com/stefanberger/libtpms/issues/183
Upstream commits: https://github.com/stefanberger/libtpms/commit/625171be0c8225824740b5d0fb7e8562f6a1c6a8 https://github.com/stefanberger/libtpms/commit/c1f7bf55099fcd427715aa65e130475c6e836a6b
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libtpmsto a version that resolves this vulnerability.Fixed in 0.8.0 - Upgrade
Upgrade
libtpmsto a version that resolves this vulnerability.Fixed in 0.8.0 - Operational
To fully fix the TPM 2 key-strength/prime-candidate algorithm issue: unseal all data, delete the old TPM state file, generate a new TPM state, then reseal the data.
Event History
Frequently Asked Questions
What is CVE-2021-3505?
CVE-2021-3505 is a vulnerability in libtpms versions before 0.8.0 that affects the TPM 2 implementation, allowing for the creation of weak 2048 bit keys.
What is the severity of CVE-2021-3505?
The severity of CVE-2021-3505 is medium with a CVSS score of 5.5.
How does CVE-2021-3505 impact my system?
CVE-2021-3505 can impact your system by allowing the generation of weak 2048 bit keys, which reduces the strength of the encryption.
Is there a fix for CVE-2021-3505?
Yes, the fix for CVE-2021-3505 is to update to libtpms version 0.8.0 or later.
Where can I find more information about CVE-2021-3505?
You can find more information about CVE-2021-3505 in the references provided: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=1950046), [link2](https://github.com/stefanberger/libtpms/issues/183), [link3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NUCZX4S53TUNTSGTCRDNOQZV2V2RI4RJ/)