Description
A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libtpms | libtpms 0.8.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libtpms | 0.8.0~dev1-1 | — |
| Debian 13 | libtpms | 0.8.0~dev1-1 | — |
| Debian 12 | libtpms | 0.8.0~dev1-1 | — |