CVE-2021-4076
📋 TL;DR
A vulnerability in tang (network-based cryptographic binding server) allows private key leakage through improper handling of cryptographic operations. This affects systems running tang servers, potentially exposing sensitive cryptographic material to attackers. Organizations using tang for disk encryption or secure boot scenarios are at risk.
💻 Affected Systems
- tang
📦 What is this software?
Tang by Tang Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of encrypted data protected by tang, including disk encryption keys and secure boot chains, leading to data theft and system compromise.
Likely Case
Unauthorized access to private keys allowing decryption of data protected by tang, potentially exposing sensitive information.
If Mitigated
Limited impact with proper network segmentation and access controls, but still represents a significant cryptographic vulnerability.
🎯 Exploit Status
The vulnerability appears to be exploitable without authentication through normal tang protocol interactions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: tang-10-2 or later (includes commit e82459fda10f0630c3414ed2afbc6320bb9ea7c9)
Vendor Advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2029814
Restart Required: Yes
Instructions:
1. Update tang package using your distribution's package manager. 2. For RHEL/CentOS: 'yum update tang'. 3. For Fedora: 'dnf update tang'. 4. Restart tang service: 'systemctl restart tangd.socket'.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to tang servers to only trusted clients
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_NETWORK" port protocol="tcp" port="7500" accept'
firewall-cmd --reload
🧯 If You Can't Patch
- Isolate tang servers in separate network segments with strict access controls
- Monitor tang server logs for unusual access patterns or key retrieval attempts
🔍 How to Verify
Check if Vulnerable:
Check tang version: 'rpm -q tang' or 'dpkg -l | grep tang'. If version is earlier than 10-2, system is vulnerable.Check Version:
rpm -q tang --queryformat '%{VERSION}-%{RELEASE}\n'Verify Fix Applied:
Verify tang version is 10-2 or later and check that commit e82459fda10f0630c3414ed2afbc6320bb9ea7c9 is included in the build.📡 Detection & Monitoring
Log Indicators:
- Unusual frequency of key advertisement requests
- Access from unexpected IP addresses to tang port 7500
Network Indicators:
- Excessive traffic to tang port 7500 from single source
- Pattern of repeated key retrieval requests
SIEM Query:
source="tang" AND (event="advertise" OR event="recrypt") | stats count by src_ip | where count > threshold🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=2029814
- https://github.com/latchset/tang/commit/e82459fda10f0630c3414ed2afbc6320bb9ea7c9
- https://github.com/latchset/tang/pull/81
- https://bugzilla.redhat.com/show_bug.cgi?id=2029814
- https://github.com/latchset/tang/commit/e82459fda10f0630c3414ed2afbc6320bb9ea7c9
- https://github.com/latchset/tang/pull/81
