CVE-2026-21444
📋 TL;DR
libtpms versions 0.10.0 and 0.10.1 have a cryptographic vulnerability where the library incorrectly returns the initial IV instead of the last IV when using certain symmetric ciphers with OpenSSL 3.x. This weakens subsequent encryption/decryption operations, potentially exposing sensitive TPM-protected data. Systems using libtpms with OpenSSL 3.x for TPM emulation are affected.
💻 Affected Systems
- libtpms
📦 What is this software?
Libtpms by Libtpms Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could decrypt TPM-protected data such as encryption keys, credentials, or sensitive configuration data, leading to complete system compromise.
Likely Case
Gradual weakening of encryption over multiple operations, potentially allowing partial decryption of protected data over time.
If Mitigated
With proper network segmentation and access controls, impact limited to specific TPM-dependent applications rather than full system compromise.
🎯 Exploit Status
Exploitation requires understanding of cryptographic operations and access to encrypted data. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10.2
Vendor Advisory: https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f
Restart Required: Yes
Instructions:
1. Download libtpms 0.10.2 from the official repository. 2. Stop all services using libtpms. 3. Compile and install the new version. 4. Restart affected services.
🔧 Temporary Workarounds
No known workarounds
allThe vulnerability is in the cryptographic implementation and cannot be mitigated without patching.
🧯 If You Can't Patch
- Isolate systems using vulnerable libtpms versions from untrusted networks
- Monitor for unusual cryptographic operations or data access patterns
🔍 How to Verify
Check if Vulnerable:
Check libtpms version with: ldd --version | grep libtpms or check package manager for installed versionCheck Version:
pkg-config --modversion libtpms 2>/dev/null || echo "libtpms not found"Verify Fix Applied:
Verify version is 0.10.2 or higher and check that OpenSSL 3.x is properly integrated📡 Detection & Monitoring
Log Indicators:
- Multiple failed cryptographic operations
- Unusual TPM access patterns
- Errors in libtpms initialization
Network Indicators:
- Unusual encrypted traffic patterns from TPM-dependent services
SIEM Query:
source="*libtpms*" AND (error OR failed OR warning) AND (crypto OR encryption OR decrypt)