Vulnerability Details : CVE-2021-3011
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
Exploit prediction scoring system (EPSS) score for CVE-2021-3011
Probability of exploitation activity in the next 30 days: 0.06%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 22 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-3011
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
1.9
|
LOW | AV:L/AC:M/Au:N/C:P/I:N/A:N |
3.4
|
2.9
|
[email protected] |
|
4.2
|
MEDIUM | CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
0.5
|
3.6
|
[email protected] |
CWE ids for CVE-2021-3011
-
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.Assigned by: [email protected] (Primary)
References for CVE-2021-3011
-
https://ninjalab.io/a-side-journey-to-titan/
Third Party Advisory
-
https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf
Exploit;Technical Description;Third Party Advisory
Products affected by CVE-2021-3011
- cpe:2.3:h:google:titan_security_key:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:3a081:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:a7005a:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2a081:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2d081_m59:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2d081_m61:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2d082_m60:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2d120_m60:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2d145_m59:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2e081_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2e082_m65:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2e120_m65:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j2e145_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3a041:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d081_m59:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d081_m59_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d081_m61:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d081_m61_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d082_m60:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d120_m60:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3d145_m59:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e016_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e016_m64_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e016_m66:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e016_m66_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e041_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e041_m64_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e041_m66:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e041_m66_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e081_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e081_m64_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e081_m66:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e081_m66_df:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e082_m65:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e120_m65:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:j3e145_m64:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:p5010:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:p5020:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:p5021:-:*:*:*:*:*:*:*
- cpe:2.3:h:nxp:p5040:-:*:*:*:*:*:*:*
- cpe:2.3:h:yubico:yubikey_neo:-:*:*:*:*:*:*:*
- cpe:2.3:h:ftsafe:k13:-:*:*:*:*:*:*:*
- cpe:2.3:h:ftsafe:k21:-:*:*:*:*:*:*:*
- cpe:2.3:h:ftsafe:k40:-:*:*:*:*:*:*:*
- cpe:2.3:h:ftsafe:k9:-:*:*:*:*:*:*:*