Skip to content
Fencer Vulns
medium 5.5

CVE-2021-3505 json

A flaw was found in libtpms in versions before 0.8.0.

published 2021-04-19 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26824

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug in the TCG specification. The bug is in the key creation algorithm in RsaAdjustPrimeCandidate(), which is called before the prime number check. The highest threat from this vulnerability is to data confidentiality.

Patch / fix

  • libtpms_project libtpms 0.8.0
  • libtpms Debian 14, Debian 13, Debian 12 0.8.0~dev1-1

debian advisories DEBIAN-CVE-2021-3505

  • libtpms Arch Linux 0.8.0-1

arch linux advisories AVG-1832

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3505 updated cvss 4.0

libtpms: RSA keys weaker than expected

  • Red Hat Enterprise Linux 8 Advanced Virtualization libtpms
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 9 libtpms
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/stefanberger/libtpms/issues/183 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a libtpms

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.