Описание
Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
Cryptographic timing vulnerabilities were discovered in certain versions of the Trusted Platform Module (TPM) firmware distributed by Intel and STMicroelectronics. Software that uses the TPM to compute ECDSA signatures could leak information through the timing of ECDSA signature operations, allowing an attacker to recover parts of the private key.
Отчет
This is a vulnerability in TPM firmware distributed by hardware vendors, not by Red Hat. Red Hat Enterprise Linux exposes the TPM device at /dev/tpm* where it is available for software with the correct privileges to use. Customers are advised to always ensure that firmware updates from hardware vendors are kept up to date with security fixes.
Меры по смягчению последствий
To remediate this vulnerability, install relevant firmware updates from your hardware vendor and follow their advice to regenerate keys that may be vulnerable or compromised. STMicroelectronics, Intel and OEMs have published firmware updates and advice at the links provided in the External References section.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | linux-firmware | Not affected | ||
| Red Hat Enterprise Linux 7 | linux-firmware | Not affected | ||
| Red Hat Enterprise Linux 8 | linux-firmware | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0 and 14.0.10; Intel(R) TXE 3.1.70 and 4.0.20; Intel(R) SPS before versions SPS_E5_04.01.04.305.0, SPS_SoC-X_04.00.04.108.0, SPS_SoC-A_04.00.04.191.0, SPS_E3_04.01.04.086.0, SPS_E3_04.08.04.047.0 may allow an unauthenticated user to potentially enable information disclosure via network access.
Уязвимость платформы для хранения учетных данных и управления ключами Intel Platform Trust Technology (PTT), микропрограммного обеспечения Intel Trusted Execution Engine (TXE) и Intel Server Platform Services, связанная с отсутствием защиты служебных данных, позволяющая нарушителю получить доступ к криптографическим ключам, хранящиеся в Trusted Platform Module (TPM)
EPSS
6.8 Medium
CVSS3