Bug 1465341 (CVE-2017-7524) - CVE-2017-7524 tpm2-tools: Sending password in plaintext for HMAC generation on server
Summary: CVE-2017-7524 tpm2-tools: Sending password in plaintext for HMAC generation o...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-7524
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1465342 1465343
Blocks: 1488600
TreeView+ depends on / blocked
 
Reported: 2017-06-27 09:20 UTC by Adam Mariš
Modified: 2021-02-17 01:59 UTC (History)
3 users (show)

Fixed In Version: tpm2-tools 1.1.1
Clone Of:
Environment:
Last Closed: 2017-09-06 06:09:56 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2017-06-27 09:20:51 UTC 
When authenticating via an HMAC to the TPM for authorization to use a policy, client sends password and message to TPM server to generate HMAC, receives it back and then uses HMAC for authorization to use an object.

Upstream patch:

https://github.com/01org/tpm2.0-tools/commit/c5d72beaab1cbbbe68271f4bc4b6670d69985157
Comment 1 Adam Mariš 2017-06-27 09:21:12 UTC 
Created tpm2-tools tracking bugs for this issue:

Affects: epel-7 [bug 1465342]
Affects: fedora-all [bug 1465343]
Comment 2 Andrej Nemec 2017-07-19 08:22:26 UTC 
Acknowledgments:

Name: William Roberts (Intel)
Upstream: Imran Desai (Intel)
Note You need to log in before you can comment on or make changes to this bug.