CVE-2020-26933

Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack.

CVSS v3 7.2 HIGH
CVSS v2.0 3.6 LOW

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 5.8

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

3.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 3.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://trustedcomputinggroup.org/about/security/	Vendor Advisory
https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf	Vendor Advisory
https://trustedcomputinggroup.org/about/security/	Vendor Advisory
https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.38::::::
	cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.40::::::
	cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.59::::::

History

21 Nov 2024, 05:20

Type	Values Removed	Values Added
CVSS	v2 : ~~3.6~~ v3 : ~~6.0~~	v2 : 3.6 v3 : 7.2
References	~~() https://trustedcomputinggroup.org/about/security/ - Vendor Advisory~~	() https://trustedcomputinggroup.org/about/security/ - Vendor Advisory
References	~~() https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf - Vendor Advisory~~	() https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf - Vendor Advisory

Information

Published : 2020-11-18 17:15

Updated : 2024-11-21 05:20

NVD link : CVE-2020-26933

Mitre link : CVE-2020-26933

CVE.ORG link : CVE-2020-26933

JSON object : View

Products Affected

trustedcomputinggroup

trusted_platform_module

CWE

CWE-665

Improper Initialization

{"id": "CVE-2020-26933", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "published": "2020-11-18T17:15:11.680", "references": [{"url": "https://trustedcomputinggroup.org/about/security/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://trustedcomputinggroup.org/about/security/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-665"}]}], "descriptions": [{"lang": "en", "value": "Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack."}, {"lang": "es", "value": "Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions versiones 1.38 hasta 1.59, presenta un Control de Acceso Inapropiado durante un apagado no ordenado de TPM que usa USE_DA_USED. Una inicializaci\u00f3n inapropiada de este apagado puede resultar en una susceptibilidad a un ataque de tipo dictionary"}], "lastModified": "2024-11-21T05:20:31.877", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.38:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F43ED59-0C7E-4BBB-8931-4033AEC36269"}, {"criteria": "cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.40:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC9AD1C2-5D7E-47FC-9B79-E57FE917FD0B"}, {"criteria": "cpe:2.3:a:trustedcomputinggroup:trusted_platform_module:2.0:revision_1.59:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FC8BA48-73AA-483B-9276-A0605B15F22F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}