Medium severity · published Nov 14, 2019
CVE-2019-16863
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar…
5.9
CVSS
3.4%
EPSS
No
On KEV
Description
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
St33tphf20i2c Firmware · ST
74.5; 74.9 · source: NVD
SF
St33tphf20spi Firmware · ST
74.0; 74.4; 74.8; 74.16 · source: NVD
SF
St33tphf2ei2c Firmware · ST
73.5; 73.9 · source: NVD
SF
St33tphf2espi Firmware · ST
71.0; 71.4; 71.12; 73.0; 73.4; 73.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16863
Third Party Advisory
http://tpm.fail
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190024
support.f5.com
https://support.f5.com/csp/article/K32412503?utm_source=f5support&%3Butm_medium=RSS
Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03972en_us
Third Party Advisory
https://support.lenovo.com/us/en/product_security/LEN-29406
Vendor Advisory
https://www.st.com/content/st_com/en/campaigns/tpm-update.html