CVE-2020-8918 : Security Advisory and Response
Learn about CVE-2020-8918 affecting Google's go-tpm TPM1.2 library versions prior to 0.3.0, allowing eavesdropping attackers to expose key authorization values. Find mitigation steps here.
Google's go-tpm TPM1.2 library versions prior to 0.3.0 are vulnerable to an eavesdropping attack that can expose key authorization values.
Understanding CVE-2020-8918
This CVE involves an improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions before 0.3.0, leading to potential key authorization value exposure.
What is CVE-2020-8918?
The vulnerability in Google's go-tpm TPM1.2 library versions prior to 0.3.0 allows an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey.
The Impact of CVE-2020-8918
- CVSS Base Score: 6.3 (Medium Severity)
- Attack Vector: Local
- Confidentiality Impact: High
- Integrity Impact: High
- Attack Complexity: High
- User Interaction: Required
- The vulnerability does not impact TPM2.0.
Technical Details of CVE-2020-8918
Vulnerability Description
An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead to key authorization value exposure.
Affected Systems and Versions
- Affected Product: google/go-tpm library
- Vendor: Google LLC
- Affected Versions: < 0.3.0
Exploitation Mechanism
- An attacker can eavesdrop on the channel to collect 'encUsageAuth' and 'encMigrationAuth' values, allowing them to calculate 'usageAuth ^ encMigrationAuth'.
Mitigation and Prevention
Immediate Steps to Take
- Update the library to version 0.3.0 or later.
- If unable to update, call CreateWrapKey with a random 20-byte value for 'migrationAuth'.
Long-Term Security Practices
- Regularly update software libraries to the latest versions.
- Implement secure communication channels to prevent eavesdropping.
Patching and Updates
- Stay informed about security advisories and apply patches promptly.