CVE-2017-15361: infineon rsa_library
Vulnerability summary
CVE-2017-15361 is a medium (CVSS 5.9) vulnerability in infineon rsa_library. EPSS estimates a 9.83% chance of exploitation in the next 30 days, higher than 95.5% of scored vulnerabilities.
Timeline
- 16-10-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
9.83%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 9.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia6 products
- chrome-token-signing< 1.0.6-1.mga6
- libdigidocpp< 3.13.2-1.mga6
- opensc< 0.15.0-2.1.mga6
- qdigidoc< 3.13.3-1.mga6
- qesteidutil< 3.12.7-2.mga6
Infineon2 products
- rsa_library≤ 1.02.013
- trusted_platform_firmware4.31 | 4.32 | 6.40 | 133.32
2 vendors · 8 products
References
25 links- www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160X Refsource MISCMitigationVendor Advisory
- dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/X Refsource MISCIssue TrackingThird Party Advisory
- blog.cr.yp.to/20171105-infineon.htmlX Refsource MISC
- ics-cert.us-cert.gov/advisories/ICSA-18-058-01X Refsource MISC
portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012X Refsource MISCIssue TrackingPatchThird Party Advisory- crocs.fi.muni.cz/public/papers/rsa_ccs17X Refsource MISCIssue TrackingMitigationThird Party Advisory
- support.lenovo.com/us/en/product_security/LEN-15552X Refsource CONFIRMMitigationThird Party Advisory
Show all 25 references
- security.netapp.com/advisory/ntap-20171024-0001/X Refsource CONFIRM
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.htmlX Refsource CONFIRM
- www.kb.cert.org/vuls/id/307015Third Party AdvisoryX Refsource CERT VNIssue TrackingMitigationUS Government Resource
- sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_updateX Refsource MISCIssue TrackingMitigationPatchThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-470231.pdfX Refsource CONFIRM
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.htmlX Refsource CONFIRM
- www.yubico.com/support/security-advisories/ysa-2017-01/X Refsource CONFIRMMitigationThird Party Advisory