Tpm2 0
Monthly
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
RSA OAEP decryption in the TPM 2.0 specification leaks timing information sufficient for a local privileged attacker to recover plaintext from TPM-managed RSA key operations, including the Endorsement Key. Affected materials include import blobs, credential blobs, and session salts, and successful exploitation may additionally enable forgery of TPM 2.0 platform attestations - a high-value outcome for supply chain and hardware attestation threat actors. No public exploit is identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low current exploitation probability, though the cryptographic sensitivity of targeted assets and the Scope:Changed metric elevate real-world risk well beyond what the moderate CVSS score alone conveys.
Credential forgery via type confusion in the TCG TPM 2.0 reference code (versions through v184) allows a local attacker holding high-privilege access to submit a falsified TPM key - such as an Attestation Key, DevID Key, or TLS authentication key - to a TPM-aware Certificate Authority and receive a legitimate credential for it. With that credential, the attacker can forge subsequent TPM 2.0 attestations, silently undermining the platform integrity guarantees that downstream security controls depend on, including measured boot verification, zero-trust device posture checks, and DevID-based network admission. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.22% at the 13th percentile is consistent with a targeted, post-compromise technique rather than a commodity attack.
RSA OAEP decryption in the TPM 2.0 specification leaks timing information sufficient for a local privileged attacker to recover plaintext from TPM-managed RSA key operations, including the Endorsement Key. Affected materials include import blobs, credential blobs, and session salts, and successful exploitation may additionally enable forgery of TPM 2.0 platform attestations - a high-value outcome for supply chain and hardware attestation threat actors. No public exploit is identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low current exploitation probability, though the cryptographic sensitivity of targeted assets and the Scope:Changed metric elevate real-world risk well beyond what the moderate CVSS score alone conveys.