Vulnerability Details : CVE-2017-15361

The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.
Publish Date : 2017-10-16 Last Update Date : 2019-10-03

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	4.3
Confidentiality Impact	Partial (There is considerable informational disclosure.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	None (There is no impact to the availability of the system.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)
CWE ID	CWE id is not defined for this vulnerability

- Products Affected By CVE-2017-15361

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	Infineon	Rsa Library	*	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
Infineon	Rsa Library	1

- References For CVE-2017-15361

https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html CONFIRM

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html CONFIRM

https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf CONFIRM

https://monitor.certipath.com/rsatest

https://keychest.net/roca

https://github.com/crocs-muni/roca

https://security.netapp.com/advisory/ntap-20171024-0001/ CONFIRM

https://blog.cr.yp.to/20171105-infineon.html

https://ics-cert.us-cert.gov/advisories/ICSA-18-058-01

https://crocs.fi.muni.cz/public/papers/rsa_ccs17

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03801en_us CONFIRM

http://www.securityfocus.com/bid/101484
BID 101484 Infineon RSA Library CVE-2017-15361 Cryptographic Security Bypass Vulnerability Release Date:2017-10-23

https://www.kb.cert.org/vuls/id/307015
CERT-VN VU#307015

http://support.lenovo.com/us/en/product_security/LEN-15552 CONFIRM

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/

https://www.yubico.com/support/security-advisories/ysa-2017-01/ CONFIRM

https://github.com/iadgov/Detect-CVE-2017-15361-TPM

https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03789en_us CONFIRM

- Vulnerability Conditions

Vulnerability is valid if product versions listed below are used 0
Infineon Rsa Library * * * *	Acer C720 Chromebook * * * Acer Chromebase * * * Acer Chromebase 24 * * * Acer Chromebook 11 C730 * * * Acer Chromebook 11 C730e * * * Acer Chromebook 11 C735 * * * Acer Chromebook 11 C740 * * * Acer Chromebook 11 C771 * * * Acer Chromebook 11 C771t * * * Acer Chromebook 11 N7 C731 * * * Acer Chromebook 13 Cb5-311 * * * Acer Chromebook 14 Cb3-431 * * * Acer Chromebook 14 For Work Cp5-471 * * * Acer Chromebook 15 Cb3-531 * * * Acer Chromebook 15 Cb3-532 * * * Acer Chromebook 15 Cb5-571 * * * Acer Chromebook R11 * * * Acer Chromebook R13 Cb5-312t * * * Acer Chromebox * * * Acer Chromebox Cxi2 * * * Aopen Chromebase * Mini * Aopen Chromebase * Commercial * Aopen Chromebox * Commercial * Aopen Chromeboxi * Mini * ASI Chromebook * * * Asus Chromebit Cs10 * * * Asus Chromebook C200 * * * Asus Chromebook C201pa * * * Asus Chromebook C202sa * * * Asus Chromebook C300 * * * Asus Chromebook C300sa * * * Asus Chromebook C301sa * * * Asus Chromebook Flip C100pa * * * Asus Chromebook Flip C302 * * * Asus Chromebox Cn60 * * * Asus Chromebox Cn62 * * * Bobicus Chromebook 11 * * * * CTL J2 Chromebook * * * CTL J4 Chromebook * * * CTL J5 Chromebook * * * CTL N6 Chromebook * * * CTL Nl61 Chromebook * * * Dell Chromebook 11 * * * Dell Chromebook 11 3120 * * * Dell Chromebook 11 3189 * * * Dell Chromebook 11 Model 3180 * * * Dell Chromebook 13 3380 * * * Dell Chromebox * * * Edugear Chromebook K * * * Edugear Chromebook M * * * Edugear Chromebook R * * * Edugear Cmt Chromebook * * * Edxis Chromebook * * * Edxis Education Chromebook * * * Epik Chromebook Elb1101 * * * Google Pixel * * * Haier Chromebook 11 * * * Haier Chromebook 11 C * * * Haier Chromebook 11 G2 * * * Haier Chromebook 11e * * * Hexa Chromebook Pi * * * Hisense Chromebook 11 * * * HP Chromebook * * * HP Chromebook 11 1100-1199 * * * HP Chromebook 11 2000-2099 * * * HP Chromebook 11 2100-2199 * * * HP Chromebook 11 2200-2299 * * * HP Chromebook 11 G1 * * * HP Chromebook 11 G2 * * * HP Chromebook 11 G3 * * * HP Chromebook 11 G4\/g4 Ee * * * HP Chromebook 11 G5 * * * HP Chromebook 11 G5 Ee * * * HP Chromebook 11-vxxx * * * HP Chromebook 13 G1 * * * HP Chromebook 14 * * * HP Chromebook 14 Ak000-099 * * * HP Chromebook 14 G3 * * * HP Chromebook 14 G4 * * * HP Chromebook 14 X000-x999 * * * HP Chromebox Cb1-\(000-099\) * * * HP Chromebox G1 * * * Infineon Trusted Platform Firmware 4.31 * * * Infineon Trusted Platform Firmware 4.32 * * * Infineon Trusted Platform Firmware 6.40 * * * Infineon Trusted Platform Firmware 133.32 * * * Lenovo 100s Chromebook * * * Lenovo N20 Chromebook * * * Lenovo N21 Chromebook * * * Lenovo N22 Chromebook * * * Lenovo N23 Chromebook * * * Lenovo N23 Flex 11 Chromebook * * * Lenovo N23 Yoga 11 Chromebook * * * Lenovo N42 Chromebook * * * Lenovo Thinkcentre Chromebox * * * Lenovo Thinkpad 11e Chromebook * * * Lenovo Thinkpad 13 Chromebook * * * LG Chromebase 22cb25s * * * LG Chromebase 22cv241 * * * Medion Akoya S2013 * * * Medion Chromebook S2015 * * * Mercer Chromebook * * * Mercer V2 Chromebook * * * Ncomputing Chromebook Cx100 * * * Nexian Chromebook * * * Pcmerge Chromebook Pcm-116t-432b * * * Poin2 Chromebook 11 * * * Poin2 Chromebook 14 * * * Positivo Chromebook Ch1190 * * * Prowise Entry Line Chromebook * * * Prowise Proline Chromebook * * * RGS Education Chromebook * * * Samsung Chromebook 2 11 * * * Samsung Chromebook 2 11 Xe500c12 * * * Samsung Chromebook 2 13 * * * Samsung Chromebook 3 * * * Samsung Chromebook Plus * * * Samsung Chromebook Pro * * * Sector-five E1 Rugged Chromebook * * * Senkatel C1101 Chromebook * * * Toshiba Chromebook * * * Toshiba Chromebook 2 * 2015 * Toshiba Chromebook 2 * * * True Idc Chromebook * * * True Idc Chromebook 11 * * * Videonet Chromebook * * * Videonet Chromebook Bl10 * * * Viglen Chromebook 11 * * * Viglen Chromebook 360 * * * Xolo Chromebook * * *
Vulnerability is valid if product versions listed below are used 0
Infineon Rsa Library * * * *	Acer C720 Chromebook * * * Acer Chromebase * * * Acer Chromebase 24 * * * Acer Chromebook 11 C730 * * * Acer Chromebook 11 C730e * * * Acer Chromebook 11 C735 * * * Acer Chromebook 11 C740 * * * Acer Chromebook 11 C771 * * * Acer Chromebook 11 C771t * * * Acer Chromebook 11 N7 C731 * * * Acer Chromebook 13 Cb5-311 * * * Acer Chromebook 14 Cb3-431 * * * Acer Chromebook 14 For Work Cp5-471 * * * Acer Chromebook 15 Cb3-531 * * * Acer Chromebook 15 Cb3-532 * * * Acer Chromebook 15 Cb5-571 * * * Acer Chromebook R11 * * * Acer Chromebook R13 Cb5-312t * * * Acer Chromebox * * * Acer Chromebox Cxi2 * * * Aopen Chromebase * Mini * Aopen Chromebase * Commercial * Aopen Chromebox * Commercial * Aopen Chromeboxi * Mini * ASI Chromebook * * * Asus Chromebit Cs10 * * * Asus Chromebook C200 * * * Asus Chromebook C201pa * * * Asus Chromebook C202sa * * * Asus Chromebook C300 * * * Asus Chromebook C300sa * * * Asus Chromebook C301sa * * * Asus Chromebook Flip C100pa * * * Asus Chromebook Flip C302 * * * Asus Chromebox Cn60 * * * Asus Chromebox Cn62 * * * Bobicus Chromebook 11 * * * * CTL J2 Chromebook * * * CTL J4 Chromebook * * * CTL J5 Chromebook * * * CTL N6 Chromebook * * * CTL Nl61 Chromebook * * * Dell Chromebook 11 * * * Dell Chromebook 11 3120 * * * Dell Chromebook 11 3189 * * * Dell Chromebook 11 Model 3180 * * * Dell Chromebook 13 3380 * * * Dell Chromebox * * * Edugear Chromebook K * * * Edugear Chromebook M * * * Edugear Chromebook R * * * Edugear Cmt Chromebook * * * Edxis Chromebook * * * Edxis Education Chromebook * * * Epik Chromebook Elb1101 * * * Google Pixel * * * Haier Chromebook 11 * * * Haier Chromebook 11 C * * * Haier Chromebook 11 G2 * * * Haier Chromebook 11e * * * Hexa Chromebook Pi * * * Hisense Chromebook 11 * * * HP Chromebook * * * HP Chromebook 11 1100-1199 * * * HP Chromebook 11 2000-2099 * * * HP Chromebook 11 2100-2199 * * * HP Chromebook 11 2200-2299 * * * HP Chromebook 11 G1 * * * HP Chromebook 11 G2 * * * HP Chromebook 11 G3 * * * HP Chromebook 11 G4\/g4 Ee * * * HP Chromebook 11 G5 * * * HP Chromebook 11 G5 Ee * * * HP Chromebook 11-vxxx * * * HP Chromebook 13 G1 * * * HP Chromebook 14 * * * HP Chromebook 14 Ak000-099 * * * HP Chromebook 14 G3 * * * HP Chromebook 14 G4 * * * HP Chromebook 14 X000-x999 * * * HP Chromebox Cb1-\(000-099\) * * * HP Chromebox G1 * * * Infineon Trusted Platform Firmware 4.31 * * * Infineon Trusted Platform Firmware 4.32 * * * Infineon Trusted Platform Firmware 6.40 * * * Infineon Trusted Platform Firmware 133.32 * * * Lenovo 100s Chromebook * * * Lenovo N20 Chromebook * * * Lenovo N21 Chromebook * * * Lenovo N22 Chromebook * * * Lenovo N23 Chromebook * * * Lenovo N23 Flex 11 Chromebook * * * Lenovo N23 Yoga 11 Chromebook * * * Lenovo N42 Chromebook * * * Lenovo Thinkcentre Chromebox * * * Lenovo Thinkpad 11e Chromebook * * * Lenovo Thinkpad 13 Chromebook * * * LG Chromebase 22cb25s * * * LG Chromebase 22cv241 * * * Medion Akoya S2013 * * * Medion Chromebook S2015 * * * Mercer Chromebook * * * Mercer V2 Chromebook * * * Ncomputing Chromebook Cx100 * * * Nexian Chromebook * * * Pcmerge Chromebook Pcm-116t-432b * * * Poin2 Chromebook 11 * * * Poin2 Chromebook 14 * * * Positivo Chromebook Ch1190 * * * Prowise Entry Line Chromebook * * * Prowise Proline Chromebook * * * RGS Education Chromebook * * * Samsung Chromebook 2 11 * * * Samsung Chromebook 2 11 Xe500c12 * * * Samsung Chromebook 2 13 * * * Samsung Chromebook 3 * * * Samsung Chromebook Plus * * * Samsung Chromebook Pro * * * Sector-five E1 Rugged Chromebook * * * Senkatel C1101 Chromebook * * * Toshiba Chromebook * * * Toshiba Chromebook 2 * 2015 * Toshiba Chromebook 2 * * * True Idc Chromebook * * * True Idc Chromebook 11 * * * Videonet Chromebook * * * Videonet Chromebook Bl10 * * * Viglen Chromebook 11 * * * Viglen Chromebook 360 * * * Xolo Chromebook * * *

- Metasploit Modules Related To CVE-2017-15361

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)