CVE

CVE-2021-3011

Severity:
MEDIUM
Type:
Unavailable / Other
Publication date:
07/01/2021
Last modified:
15/02/2024

Description

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).

Impact

Vector 3.x
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 4.20 MEDIUM
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV): Physical
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

Base Score 3.x
4.20
Severity 3.x
MEDIUM
Vector 2.0
AV:L/AC:M/Au:N/C:P/I:N/A:N CVSS v2.0 Severity and Metrics:

Base Score: 1.90 LOW
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N

Attack Vector (AV): Local
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): None
Availability (A): None

Base Score 2.0
1.90
Severity 2.0
LOW

Vulnerable products and versions

CPE From Up to
cpe:2.3:h:ftsafe:k13:-:*:*:*:*:*:*:*
cpe:2.3:h:ftsafe:k21:-:*:*:*:*:*:*:*
cpe:2.3:h:ftsafe:k40:-:*:*:*:*:*:*:*
cpe:2.3:h:ftsafe:k9:-:*:*:*:*:*:*:*
cpe:2.3:h:google:titan_security_key:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:3a081:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:a7005a:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2a081:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2d081_m59:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2d081_m61:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2d082_m60:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2d120_m60:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2d145_m59:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2e081_m64:-:*:*:*:*:*:*:*
cpe:2.3:h:nxp:j2e082_m65:-:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools