CVE-2017-15361

Published: Oct 16, 2017Modified: May 13, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.

Affected (5)

Products: Infineon: Trusted Platform Firmware, Rsa Library

Infineon

2 products

Trusted Platform Firmware

Rsa Library

Configuration A

4 vulnerable · 126 platform

Vulnerable Software	Affected Versions
Infineon Trusted Platform Firmware	Version 133.32
Infineon Trusted Platform Firmware	Version 4.31
Infineon Trusted Platform Firmware	Version 4.32
Infineon Trusted Platform Firmware	Version 6.40

Running on/with	Platform Versions
Acer C720 Chromebook	All versions
Acer Chromebase	All versions
Acer Chromebase 24	All versions
Acer Chromebook 11 C730	All versions
Acer Chromebook 11 C730e	All versions
Acer Chromebook 11 C735	All versions
Acer Chromebook 11 C740	All versions
Acer Chromebook 11 C771	All versions
Acer Chromebook 11 C771t	All versions
Acer Chromebook 11 N7 C731	All versions
Acer Chromebook 13 Cb5 311	All versions
Acer Chromebook 14 Cb3 431	All versions
Acer Chromebook 14 For Work Cp5 471	All versions
Acer Chromebook 15 Cb3 531	All versions
Acer Chromebook 15 Cb3 532	All versions
Acer Chromebook 15 Cb5 571	All versions
Acer Chromebook R11	All versions
Acer Chromebook R13 Cb5 312t	All versions
Acer Chromebox	All versions
Acer Chromebox Cxi2	All versions
Aopen Chromebase	All versions
Aopen Chromebase	All versions
Aopen Chromebox	All versions
Aopen Chromeboxi	All versions
Asi Chromebook	All versions
Asus Chromebit Cs10	All versions
Asus Chromebook C200	All versions
Asus Chromebook C201pa	All versions
Asus Chromebook C202sa	All versions
Asus Chromebook C300	All versions
Asus Chromebook C300sa	All versions
Asus Chromebook C301sa	All versions
Asus Chromebook Flip C100pa	All versions
Asus Chromebook Flip C302	All versions
Asus Chromebox Cn60	All versions
Asus Chromebox Cn62	All versions
Bobicus Chromebook 11	All versions
Ctl J2 Chromebook	All versions
Ctl J4 Chromebook	All versions
Ctl J5 Chromebook	All versions
Ctl N6 Chromebook	All versions
Ctl Nl61 Chromebook	All versions
Dell Chromebook 11	All versions
Dell Chromebook 11 3120	All versions
Dell Chromebook 11 3189	All versions
Dell Chromebook 11 Model 3180	All versions
Dell Chromebook 13 3380	All versions
Dell Chromebox	All versions
Edugear Chromebook K	All versions
Edugear Chromebook M	All versions
Edugear Chromebook R	All versions
Edugear Cmt Chromebook	All versions
Edxis Chromebook	All versions
Edxis Education Chromebook	All versions
Epik Chromebook Elb1101	All versions
Google Pixel	All versions
Haier Chromebook 11	All versions
Haier Chromebook 11 C	All versions
Haier Chromebook 11 G2	All versions
Haier Chromebook 11e	All versions
Hexa Chromebook Pi	All versions
Hisense Chromebook 11	All versions
Hp Chromebook	All versions
Hp Chromebook 11 Vxxx	All versions
Hp Chromebook 11 1100 1199	All versions
Hp Chromebook 11 2000 2099	All versions
Hp Chromebook 11 2100 2199	All versions
Hp Chromebook 11 2200 2299	All versions
Hp Chromebook 11 G1	All versions
Hp Chromebook 11 G2	All versions
Hp Chromebook 11 G3	All versions
Hp Chromebook 11 G4/g4 Ee	All versions
Hp Chromebook 11 G5	All versions
Hp Chromebook 11 G5 Ee	All versions
Hp Chromebook 13 G1	All versions
Hp Chromebook 14	All versions
Hp Chromebook 14 Ak000 099	All versions
Hp Chromebook 14 G3	All versions
Hp Chromebook 14 G4	All versions
Hp Chromebook 14 X000 X999	All versions
Hp Chromebox Cb1 (000 099)	All versions
Hp Chromebox G1	All versions
Lenovo 100s Chromebook	All versions
Lenovo N20 Chromebook	All versions
Lenovo N21 Chromebook	All versions
Lenovo N22 Chromebook	All versions
Lenovo N23 Chromebook	All versions
Lenovo N23 Flex 11 Chromebook	All versions
Lenovo N23 Yoga 11 Chromebook	All versions
Lenovo N42 Chromebook	All versions
Lenovo Thinkcentre Chromebox	All versions
Lenovo Thinkpad 11e Chromebook	All versions
Lenovo Thinkpad 13 Chromebook	All versions
Lg Chromebase 22cb25s	All versions
Lg Chromebase 22cv241	All versions
Medion Akoya S2013	All versions
Medion Chromebook S2015	All versions
Mercer Chromebook	All versions
Mercer V2 Chromebook	All versions
Ncomputing Chromebook Cx100	All versions
Nexian Chromebook	All versions
Pcmerge Chromebook Pcm 116t 432b	All versions
Poin2 Chromebook 11	All versions
Poin2 Chromebook 14	All versions
Positivo Chromebook Ch1190	All versions
Prowise Entry Line Chromebook	All versions
Prowise Proline Chromebook	All versions
Rgs Education Chromebook	All versions
Samsung Chromebook 2 11	All versions
Samsung Chromebook 2 11 Xe500c12	All versions
Samsung Chromebook 2 13	All versions
Samsung Chromebook 3	All versions
Samsung Chromebook Plus	All versions
Samsung Chromebook Pro	All versions
Sector Five E1 Rugged Chromebook	All versions
Senkatel C1101 Chromebook	All versions
Toshiba Chromebook	All versions
Toshiba Chromebook 2	All versions
Toshiba Chromebook 2	All versions
True Idc Chromebook	All versions
True Idc Chromebook 11	All versions
Videonet Chromebook	All versions
Videonet Chromebook Bl10	All versions
Viglen Chromebook 11	All versions
Viglen Chromebook 360	All versions
Xolo Chromebook	All versions

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Infineon Rsa Library	Up to 1.02.013

References (44)

http://support.lenovo.com/us/en/product_security/LEN-15552

Source: cve@mitre.org

MitigationThird Party Advisory

http://www.securityfocus.com/bid/101484

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://blog.cr.yp.to/20171105-infineon.html

Source: cve@mitre.org

https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf

Source: cve@mitre.org

https://crocs.fi.muni.cz/public/papers/rsa_ccs17

Source: cve@mitre.org

Issue TrackingMitigationThird Party Advisory

https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/crocs-muni/roca

Source: cve@mitre.org

MitigationThird Party Advisory

https://github.com/iadgov/Detect-CVE-2017-15361-TPM

Source: cve@mitre.org

MitigationThird Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSA-18-058-01

Source: cve@mitre.org

https://keychest.net/roca

Source: cve@mitre.org

Issue TrackingMitigationThird Party Advisory

https://monitor.certipath.com/rsatest

Source: cve@mitre.org

MitigationThird Party Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://security.netapp.com/advisory/ntap-20171024-0001/

Source: cve@mitre.org

https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update

Source: cve@mitre.org

Issue TrackingMitigationPatchThird Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03789en_us

Source: cve@mitre.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03801en_us

Source: cve@mitre.org

https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160

Source: cve@mitre.org

MitigationVendor Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html

Source: cve@mitre.org

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html

Source: cve@mitre.org

https://www.kb.cert.org/vuls/id/307015

Source: cve@mitre.org

Issue TrackingMitigationThird Party AdvisoryUS Government Resource

https://www.yubico.com/support/security-advisories/ysa-2017-01/

Source: cve@mitre.org

MitigationThird Party Advisory

http://support.lenovo.com/us/en/product_security/LEN-15552