EUVD-2026-56223
GHSA-fv5r-gp2c-7mwv
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
PR:L better reflects 'privileged local attacker' requiring TPM interface access; I:L added because attestation forgery represents a concrete integrity impact on relying systems.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
AnalysisAI
RSA OAEP decryption in the TPM 2.0 specification leaks timing information sufficient for a local privileged attacker to recover plaintext from TPM-managed RSA key operations, including the Endorsement Key. Affected materials include import blobs, credential blobs, and session salts, and successful exploitation may additionally enable forgery of TPM 2.0 platform attestations - a high-value outcome for supply chain and hardware attestation threat actors. No public exploit is identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low current exploitation probability, though the cryptographic sensitivity of targeted assets and the Scope:Changed metric elevate real-world risk well beyond what the moderate CVSS score alone conveys.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) is the root cause: the TPM 2.0 RSA OAEP decryption path exhibits non-constant-time behavior, enabling statistical analysis of response timing to recover secret information. The affected component is identified via CPE as cpe:2.3:a:trusted_computing_group:tpm2.0:*:*:*:*:*:*:*:*, covering the TPM 2.0 specification and conformant implementations up to revision v184. RSA-OAEP (Optimal Asymmetric Encryption Padding) is the padding scheme used to protect key import blobs, credential activation blobs (central to remote attestation protocols such as TPM-based device health checks), and session salts. The RSA Endorsement Key (EK) is a hardware-bound key whose compromise fundamentally undermines TPM trust anchors. This class of attack has well-established academic precedent in Bleichenbacher-style oracles against RSA PKCS#1 v1.5 and OAEP, and while the TCG specification mandates constant-time decryption, firmware-level implementations from individual silicon vendors may diverge. TCG catalogues this issue as TCGVRT0011.
RemediationAI
The primary remediation is to apply TPM firmware updates issued by the specific TPM silicon vendor in response to TCG advisory TCGVRT0011; no single universal patched specification version exists, and each OEM or TPM chip manufacturer must release their own firmware fix - no vendor-specific patched version numbers are confirmed in available data at time of analysis. Consult the TCG advisory at https://trustedcomputinggroup.org/wp-content/uploads/VRT0011-Advisory_Final-1.pdf and the extended guidance at https://trustedcomputinggroup.org/wp-content/uploads/Extended-vrt0010-11-guidance_V1.pdf for vendor-specific references and remediation direction. As a compensating control where firmware updates are unavailable, restrict access to the TPM command interface at the OS level - on Linux, limit permissions on /dev/tpm0 and /dev/tpmrm0 to root or a dedicated tpm group; on Windows, enforce least-privilege policies through the TPM Base Services (TBS) API. This substantially raises the bar for the timing oracle by limiting who can submit the large volume of crafted decryption queries required. Note that tightening TPM device permissions may affect legitimate software relying on TPM access such as disk encryption agents, measured boot daemons, and TPM-aware credential managers, so testing in staging is advised before broad deployment.
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today