CVE-2017-15361 The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133...
MediumCVSS 5.9
EPSS 9.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infineon trusted platform firmware | = 4.31 | No fix listed |
| infineon trusted platform firmware | = 4.32 | No fix listed |
| infineon trusted platform firmware | = 6.40 | No fix listed |
| infineon trusted platform firmware | = 133.32 | No fix listed |
| infineon rsa library | <= 1.02.013 | No fix listed |
References
- support.lenovo.com mitigation third-party-advisory
- 101484 third-party-advisory vdb-entry
- arstechnica.com issue-tracking third-party-advisory
- blog.cr.yp.to
- cert-portal.siemens.com
- crocs.fi.muni.cz issue-tracking mitigation third-party-advisory
- dan.enigmabridge.com issue-tracking third-party-advisory
- github.com mitigation third-party-advisory
- github.com mitigation third-party-advisory
- ics-cert.us-cert.gov
- keychest.net issue-tracking mitigation third-party-advisory
- monitor.certipath.com mitigation third-party-advisory
- portal.msrc.microsoft.com issue-tracking patch third-party-advisory
- security.netapp.com
- sites.google.com issue-tracking mitigation patch third-party-advisory
- support.hpe.com
- support.hpe.com
- www.infineon.com mitigation vendor-advisory
- www.intel.com
- www.intel.com
- VU#307015 issue-tracking mitigation third-party-advisory us-government-resource
- www.yubico.com mitigation third-party-advisory