TPM 2.0: timing side channel in RSA OAEP decryption can expose TPM-managed key material and forge attestations

Impact

A privileged local attacker with access to the TPM command interface can measure timing differences in RSA OAEP decryption and recover information that allows decryption of ciphertexts sealed to TPM-managed RSA keys, including the Endorsement Key, import blobs, credential blobs and session salts. Under some conditions this extends to forging TPM 2.0 attestations. For a GPU fleet that gates confidential computing, disk unsealing or node admission on TPM attestation, a forged quote means a node that is not in the state it claims can still join the cluster and receive tenant workloads. The trust anchor is the thing broken here, so every downstream check built on it inherits the doubt.

Who can reach it

A local attacker holding privileged access to the TPM command interface on the host (root or equivalent, via /dev/tpm0 or the platform firmware path). Not reachable from a tenant container without that access, and not remote.

What to do

The TCG advisory (TCGVRT0011) is the authority here; the record names no fixed version, so do not assume one. Fixes arrive as TPM firmware or platform BIOS updates from the TPM and server vendors, which means flashing each affected node with it out of service - a per-node maintenance window across the fleet. Until vendor firmware ships, treat TPM-sealed secrets and remote attestation results as weaker than assumed: keep the TPM interface restricted to root, and do not rely on TPM quotes alone for node admission on hosts where untrusted code can gain root.

References

Related entries

• Arista EOS (security ACL vs NAT rule interaction): A security ACL drop rule is bypassed when a NAT ACL permit ruleCVE-2021-28511 · Arista EOS (security ACL vs NAT rule interaction)Medium
• AMI MegaRAC SPx 12 (BMC default TLS certificate): The BMC ships with a hard-coded default TLS certificate, so HTTPSCVE-2021-4228 · AMI MegaRAC SPx 12 (BMC default TLS certificate)Medium
• AMI MegaRAC SPx 12 / SPx 13 (BMC web session management): Session fixation combined with sessions that never properlyCVE-2021-46279 · AMI MegaRAC SPx 12 / SPx 13 (BMC web session management)Medium
• Tyan S5552 BMC web interface, firmware version 3.00: An unauthenticated attacker downloads the BMC's TLS private keyCVE-2023-2538 · Tyan S5552 BMC web interface, firmware version 3.00Medium
• Dell iDRAC Service Module (out-of-bounds write): Out-of-bounds write allowing a privileged local attacker to executeCVE-2024-38490 · Dell iDRAC Service Module (out-of-bounds write)Medium
• Arista EOS (PBR / BGP Flowspec / interface traffic policy): IPv4 packets carrying IP options can bypass policy-basedCVE-2024-6437 · Arista EOS (PBR / BGP Flowspec / interface traffic policy)Medium