CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
21.7%
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check.
CVEID:CVE-2021-3505
**DESCRIPTION:**libtpms could allow a local attacker to obtain sensitive information, caused by an issue with the TPM 2 implementation returns 2048 bit keys with ~1984 bit strength. By utilize cryptographic attack techniques, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200459 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
PowerVM Hypervisor | FW1050 (all versions using vTPM 2.0 with encryption level Power10v1) |
PowerVM Hypervisor | FW1030 (all versions using vTPM 2.0) |
PowerVM Hypervisor | FW1020 (all versions using vTPM 2.0) |
IBM recommends customers with the products below install FW1050.00 or newer and perform the mitigation steps below to remediate this vulnerability.
Power 10
IBM Power System E1080 (9080-HEX)
IBM Power System S1022 (9105-22A)
IBM Power System S1024 (9105-42A)
IBM Power System S1022s (9105-22B)
IBM Power System S1014 (9105-41B)
IBM Power System L1022 (9786-22H)
IBM Power System L1024 (9786-42H)
IBM Power System E1050 (9043-MRX)
To fully mitigate your system you must update all partitions that are using vTPM2.0 to the ‘Power10v2’ encryption level or higher. Please follow the detailed steps outlined here to accomplish that: <https://ibm.biz/BdvGpX>
N/A
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | powervm_hypervisor_fw1050_\(all_versions_using_vtpm | 2.0 | cpe:2.3:a:ibm:powervm_hypervisor_fw1050_\(all_versions_using_vtpm:2.0:*:*:*:*:*:*:* |
ibm | powervm_hypervisor_fw1030_\(all_versions_using_vtpm | 2.0 | cpe:2.3:a:ibm:powervm_hypervisor_fw1030_\(all_versions_using_vtpm:2.0:*:*:*:*:*:*:* |
ibm | powervm_hypervisor_fw1020_\(all_versions_using_vtpm | 2.0 | cpe:2.3:a:ibm:powervm_hypervisor_fw1020_\(all_versions_using_vtpm:2.0:*:*:*:*:*:*:* |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
21.7%