Candidate: CVE-2021-3505
PublicDate: 2021-04-19 21:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3505
 https://github.com/stefanberger/libtpms/issues/183
 https://github.com/stefanberger/libtpms/commit/625171be0c8225824740b5d0fb7e8562f6a1c6a8 (v0.8.0)
 https://github.com/stefanberger/libtpms/commit/c1f7bf55099fcd427715aa65e130475c6e836a6b (v0.8.0)
 https://bugzilla.redhat.com/show_bug.cgi?id=1950046
Description:
 A flaw was found in libtpms in versions before 0.8.0. The TPM 2
 implementation returns 2048 bit keys with ~1984 bit strength due to a bug
 in the TCG specification. The bug is in the key creation algorithm in
 RsaAdjustPrimeCandidate(), which is called before the prime number check.
 The highest threat from this vulnerability is to data confidentiality.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [5.5 MEDIUM]


Patches_libtpms:
upstream_libtpms: released (0.8.0~dev1-1)
precise/esm_libtpms: DNE
trusty_libtpms: ignored (out of standard support)
trusty/esm_libtpms: DNE
xenial_libtpms: DNE
bionic_libtpms: DNE
focal_libtpms: DNE
groovy_libtpms: not-affected (0.8.0~dev1-1.1)
devel_libtpms: not-affected