VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks
<h3 id="overview">Overview</h3> <p>Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation:</p> <ol> <li><strong>CVE-2026-6726</strong> – Information leakage via falsified TPM keys.</li> <li><strong>CVE-2026-6727</strong> – A timing side-channel vulnerability in RSA OAEP decryption.</li> </ol> <p>An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations.<br> These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories - <a href="https://trustedcomputinggroup.org/about/security/#willa"><strong>TCGVRT010 and TCGVRT0011</strong>:</a></p> <h3 id="description">Description</h3> <p>Trusted Platform Module (TPM) technology provides hardware-backed cryptographic services for modern computing platforms. TPMs are designed to resist tampering and may be implemented as discrete chips, integrated hardware, firmware-based TPMs (fTPMs), or software implementations used in cloud and virtualized environments.<br> The Trusted Computing Group (TCG) maintains the TPM specifications and publishes a reference implementation to assist vendors in developing TPM-compliant products.</p> <p>Two vulnerabilities were identified in the TPM 2.0 reference implementation.</p> <p><strong>CVE-2026-6727</strong> <br> A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations.</p> <p><strong>CVE-2026-6726</strong><br> An information leakage vulnerability could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key, such as an Attestation Key (AK), DevID key, or TLS authentication key. This could enable the creation of fraudulent TPM 2.0 attestations using the forged key.</p> <p>Both vulnerabilities require privileged access to the TPM command interface. Multiple vendors have released firmware and software updates incorporating fixes from the updated TPM 2.0 reference implementation.</p> <h3 id="impact">Impact</h3> <p>Successful exploitation requires privileged local access to a TPM command interface. Depending on the vulnerability exploited, an attacker may be able to:<br> - Decrypt ciphertexts encrypted to the TPM-managed RS keys, including the RSA Endorsement Key (EK), , including credential blobs, import blobs, and session salts.<br> - Obtain credentials for falsified TPM keys.<br> - Produce fraudulent TPM 2.0 attestations that appear to originate from a legitimate TPM.</p> <p>The overall impact depends on the affected TPM implementation and how TPM-based attestation and key management are used by the platform. </p> <h3 id="solution">Solution</h3> <p>The vulnerabilities originate in the TPM 2.0 reference implementation, and TPM vendors have incorporated the corresponding fixes into updated firmware and software releases. Users should install TPM firmware updates, operating system updates, or software patches provided by their platform or TPM vendor.</p> <p>Cloud providers using software-based TPM implementations may also have deployed updates. Customers should consult their cloud provider's guidance to determine whether any additional action is required. See the <strong>Vendor Information</strong> section for product-specific remediation guidance.</p> <h2 id="acknowledgements">Acknowledgements</h2> <p>Thanks to security researchers Liran Perez, Zecharye Galitzky, Shai Sarfati, and Yanai Moyal from Intel for reporting these vulnerabilities. Thanks to members of the Trusted Computing Group’s Vulnerability Response Team, TCG VRT, for working with CERT/CC towards this multi-party vulnerability disclosure. This document was written by Vijay Sarvepalli.</p>