CVE-2021-33881 : On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write opera

On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc.

Published 2021-06-06 16:15:07

Updated 2021-06-17 16:39:54

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2021-33881

NXP » Mifare Ultralight Ev1 Firmware » Version: N/A
cpe:2.3:o:nxp:mifare_ultralight_ev1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Mifare Ultralight Ev1 » Version: N/A
NXP » Mifare Ultralight C Firmware » Version: N/A
cpe:2.3:o:nxp:mifare_ultralight_c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Mifare Ultralight C » Version: N/A
NXP » Mifare Ultralight Nano Firmware » Version: N/A
cpe:2.3:o:nxp:mifare_ultralight_nano_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Mifare Ultralight Nano » Version: N/A
NXP » Ntag 210 Firmware » Version: N/A
cpe:2.3:o:nxp:ntag_210_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Ntag 210 » Version: N/A
NXP » Ntag 212 Firmware » Version: N/A
cpe:2.3:o:nxp:ntag_212_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Ntag 212 » Version: N/A
NXP » Ntag 213 Firmware » Version: N/A
cpe:2.3:o:nxp:ntag_213_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Ntag 213 » Version: N/A
NXP » Ntag 215 Firmware » Version: N/A
cpe:2.3:o:nxp:ntag_215_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Ntag 215 » Version: N/A
NXP » Ntag 216 Firmware » Version: N/A
cpe:2.3:o:nxp:ntag_216_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NXP » Ntag 216 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-33881

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-33881

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
1.9	LOW	AV:L/AC:M/Au:N/C:N/I:P/A:N	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.2	MEDIUM	CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	0.5	3.6	NIST
Attack Vector: Physical Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2021-33881

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-33881

https://www.nxp.com/docs/en/application-note/AN11340.pdf

Vendor Advisory
https://www.sstic.org/2021/presentation/eeprom_it_will_all_end_in_tears/

SSTIC2021 » Présentation » EEPROM: It Will All End in Tears - Christian Herrmann, Philippe Teuwen
Exploit;Third Party Advisory
https://blog.quarkslab.com/rfid-monotonic-counter-anti-tearing-defeated.html

RFID: Monotonic Counter Anti-Tearing Defeated
Mitigation;Third Party Advisory
https://www.nxp.com/docs/en/application-note/AN13089.pdf

Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-33881

Products affected by CVE-2021-33881

Exploit prediction scoring system (EPSS) score for CVE-2021-33881

CVSS scores for CVE-2021-33881

CWE ids for CVE-2021-33881

References for CVE-2021-33881