Stefan Mileschin

Allows an attacker to retrieve cryptographic keys

Intel has fixed two vulnerabilities discovered by a team of academics called TPM-FAIL that could allow an attacker to retrieve cryptographic keys stored inside TPMs.

TPM stands for Trusted Platform Module and in the early days TPMs were separate chips added to a motherboard where a CPU would store and manage sensitive information such as cryptographic keys.

They were used to ensure hardware integrity during the boot-up process or to attest various cryptographic operations, such as handling digital certificates, ensuring HTTPS connections on servers, or verifying authentication-related processes.

With the rise of smart devices, there was no room for a separate TPM chipset on all devices and they became software in firmware-based known as fTPMs.

Boffins at Worcester Polytechnic Institute (USA), the University of Lübeck (Germany), and the University of California, San Diego (USA) have disclosed two vulnerabilities that impact two very widely used TPM solutions.

The first vulnerability is CVE-2019-11090 and impacts Intel's Platform Trust Technology (PTT).

https://fudzilla.com/news/49794-inte...-from-tpm-fail