Riskcovery

CVE-2024-32482

Tillitis TKey Signer possible RAM disclosure vulnerability

State
Published
Severity
2.2 Low
Published
Apr 23, 2024
Updated
Aug 2, 2024
Reserved
Apr 12, 2024

Read the record on cve.org

Description

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.

Scores

CVSSScoreVectorSource
3.12.2 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-125 Out-of-bounds Read
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

ProductVersions
tkey-device-signertillitis
  • < 1.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.