libtpms (OpenSSL 3.x symmetric cipher IV handling): libtpms 0.10.0/0.10.1 built against OpenSSL 3.x returned

UnscoredCVE-2026-21444Firmware, BMC & network fabriccurated

Impact

libtpms 0.10.0/0.10.1 built against OpenSSL 3.x returned the initial IV instead of the last IV for certain symmetric ciphers, weakening every subsequent encrypt and decrypt step in the chain. Anything a tenant's vTPM encrypted - sealed keys, protected blobs - is protected less than the cryptography claims. Quiet failure mode: nothing errors, the data is just weaker than the threat model assumes, and you only find out when someone attacks it.

Who can reach it

No active attacker needed to introduce the weakness - it is present in every affected operation. Exploiting it requires an attacker who obtains the ciphertext, which for vTPM state means host-level access or a leaked VM state file.

What to do

libtpms package update on hypervisor hosts and restart the swtpm processes. Because the weakness is in data already produced, rotate anything a vulnerable vTPM sealed rather than assuming the update is retroactive. Package-level, no firmware flash - but the re-sealing step is the part that takes planning on a fleet with long-lived guests.

References

https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f https://nvd.nist.gov/vuln/detail/CVE-2026-21444

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.