Security Bulletin: This Power System update is being released to address CVE-2021-3505

Summary

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check.

Vulnerability Details

CVEID:CVE-2021-3505
**DESCRIPTION:**libtpms could allow a local attacker to obtain sensitive information, caused by an issue with the TPM 2 implementation returns 2048 bit keys with ~1984 bit strength. By utilize cryptographic attack techniques, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/200459 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM recommends customers with the products below install FW1050.00 or newer and perform the mitigation steps below to remediate this vulnerability.

Power 10

1. IBM Power System E1080 (9080-HEX)

2. IBM Power System S1022 (9105-22A)

3. IBM Power System S1024 (9105-42A)

4. IBM Power System S1022s (9105-22B)

5. IBM Power System S1014 (9105-41B)

6. IBM Power System L1022 (9786-22H)

7. IBM Power System L1024 (9786-42H)

8. IBM Power System E1050 (9043-MRX)

To fully mitigate your system you must update all partitions that are using vTPM2.0 to the ‘Power10v2’ encryption level or higher. Please follow the detailed steps outlined here to accomplish that: <https://ibm.biz/BdvGpX&gt;

Workarounds and Mitigations

N/A