CVE-2021-32015: Medium severity nuvoton npct75x firmware vulnerability
In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32015?
CVE-2021-32015 is considered a high severity vulnerability due to the potential unauthorized access to sensitive TPM non-volatile memory.
How do I fix CVE-2021-32015?
To mitigate CVE-2021-32015, upgrade the Nuvoton NPCT75x TPM firmware to version 7.4.0.1.
Who is affected by CVE-2021-32015?
CVE-2021-32015 affects users of the Nuvoton NPCT75x TPM firmware version 7.4.0.0.
What could an attacker exploit in CVE-2021-32015?
An attacker could exploit CVE-2021-32015 to gain unauthorized access to the TPM's non-volatile memory with high privileges.
Is the fix for CVE-2021-32015 compliant with TCG standards?
No, version 7.4.0.1, which mitigates CVE-2021-32015, is not compliant with TCG or Common Criteria standards.