CVE Feed

    Dashboard / CVE / CVE-2017-15361

    CVE-2017-15361

    The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles RSA key generation, which makes it easier for attackers to defeat various cryptographic protection mechanisms via targeted attacks, aka ROCA. Examples of affected technologies include BitLocker with TPM 1.2, YubiKey 4 (before 4.3.5) PGP key generation, and the Cached User Data encryption feature in Chrome OS.

    Published:Oct 16, 2017
    Last Modified:Apr 20, 2025
    EPS:Oct 16, 2017
    EPSS Score:0.69294
    CVSS Score:5.9

    Affected Products

    Vendor
    Acer
    Product
    C720 Chromebook
    Vendor
    Acer
    Product
    Chromebase
    Vendor
    Acer
    Product
    Chromebase 24
    Vendor
    Acer
    Product
    Chromebook 11 C730
    Vendor
    Acer
    Product
    Chromebook 11 C730e
    Vendor
    Acer
    Product
    Chromebook 11 C735
    Vendor
    Acer
    Product
    Chromebook 11 C740
    Vendor
    Acer
    Product
    Chromebook 11 C771
    Vendor
    Acer
    Product
    Chromebook 11 C771t
    Vendor
    Acer
    Product
    Chromebook 11 N7 C731
    Vendor
    Acer
    Product
    Chromebook 13 Cb5-311
    Vendor
    Acer
    Product
    Chromebook 14 Cb3-431
    Vendor
    Acer
    Product
    Chromebook 14 For Work Cp5-471
    Vendor
    Acer
    Product
    Chromebook 15 Cb3-531
    Vendor
    Acer
    Product
    Chromebook 15 Cb3-532
    Vendor
    Acer
    Product
    Chromebook 15 Cb5-571
    Vendor
    Acer
    Product
    Chromebook R11
    Vendor
    Acer
    Product
    Chromebook R13 Cb5-312t
    Vendor
    Acer
    Product
    Chromebox
    Vendor
    Acer
    Product
    Chromebox Cxi2
    Vendor
    Aopen
    Product
    Chromebase
    Vendor
    Aopen
    Product
    Chromebox
    Vendor
    Aopen
    Product
    Chromeboxi
    Vendor
    Asi
    Product
    Chromebook
    Vendor
    Asus
    Product
    Chromebit Cs10
    Vendor
    Asus
    Product
    Chromebook C200
    Vendor
    Asus
    Product
    Chromebook C201pa
    Vendor
    Asus
    Product
    Chromebook C202sa
    Vendor
    Asus
    Product
    Chromebook C300
    Vendor
    Asus
    Product
    Chromebook C300sa
    Vendor
    Asus
    Product
    Chromebook C301sa
    Vendor
    Asus
    Product
    Chromebook Flip C100pa
    Vendor
    Asus
    Product
    Chromebook Flip C302
    Vendor
    Asus
    Product
    Chromebox Cn60
    Vendor
    Asus
    Product
    Chromebox Cn62
    Vendor
    Bobicus
    Product
    Chromebook 11
    Vendor
    Ctl
    Product
    J2 Chromebook
    Vendor
    Ctl
    Product
    J4 Chromebook
    Vendor
    Ctl
    Product
    J5 Chromebook
    Vendor
    Ctl
    Product
    N6 Chromebook
    Vendor
    Ctl
    Product
    Nl61 Chromebook
    Vendor
    Dell
    Product
    Chromebook 11
    Vendor
    Dell
    Product
    Chromebook 11 3120
    Vendor
    Dell
    Product
    Chromebook 11 3189
    Vendor
    Dell
    Product
    Chromebook 11 Model 3180
    Vendor
    Dell
    Product
    Chromebook 13 3380
    Vendor
    Dell
    Product
    Chromebox
    Vendor
    Edugear
    Product
    Chromebook K
    Vendor
    Edugear
    Product
    Chromebook M
    Vendor
    Edugear
    Product
    Chromebook R
    Vendor
    Edugear
    Product
    Cmt Chromebook
    Vendor
    Edxis
    Product
    Chromebook
    Vendor
    Edxis
    Product
    Education Chromebook
    Vendor
    Epik
    Product
    Chromebook Elb1101
    Vendor
    Google
    Product
    Pixel
    Vendor
    Haier
    Product
    Chromebook 11
    Vendor
    Haier
    Product
    Chromebook 11 C
    Vendor
    Haier
    Product
    Chromebook 11 G2
    Vendor
    Haier
    Product
    Chromebook 11e
    Vendor
    Hexa
    Product
    Chromebook Pi
    Vendor
    Hisense
    Product
    Chromebook 11
    Vendor
    Hp
    Product
    Chromebook
    Vendor
    Hp
    Product
    Chromebook 11-vxxx
    Vendor
    Hp
    Product
    Chromebook 11 1100-1199
    Vendor
    Hp
    Product
    Chromebook 11 2000-2099
    Vendor
    Hp
    Product
    Chromebook 11 2100-2199
    Vendor
    Hp
    Product
    Chromebook 11 2200-2299
    Vendor
    Hp
    Product
    Chromebook 11 G1
    Vendor
    Hp
    Product
    Chromebook 11 G2
    Vendor
    Hp
    Product
    Chromebook 11 G3
    Vendor
    Hp
    Product
    Chromebook 11 G4\/g4 Ee
    Vendor
    Hp
    Product
    Chromebook 11 G5
    Vendor
    Hp
    Product
    Chromebook 11 G5 Ee
    Vendor
    Hp
    Product
    Chromebook 13 G1
    Vendor
    Hp
    Product
    Chromebook 14
    Vendor
    Hp
    Product
    Chromebook 14 Ak000-099
    Vendor
    Hp
    Product
    Chromebook 14 G3
    Vendor
    Hp
    Product
    Chromebook 14 G4
    Vendor
    Hp
    Product
    Chromebook 14 X000-x999
    Vendor
    Hp
    Product
    Chromebox Cb1-\(000-099\)
    Vendor
    Hp
    Product
    Chromebox G1
    Vendor
    Infineon
    Product
    Rsa Library
    Vendor
    Infineon
    Product
    Trusted Platform Firmware
    Vendor
    Lenovo
    Product
    100s Chromebook
    Vendor
    Lenovo
    Product
    N20 Chromebook
    Vendor
    Lenovo
    Product
    N21 Chromebook
    Vendor
    Lenovo
    Product
    N22 Chromebook
    Vendor
    Lenovo
    Product
    N23 Chromebook
    Vendor
    Lenovo
    Product
    N23 Flex 11 Chromebook
    Vendor
    Lenovo
    Product
    N23 Yoga 11 Chromebook
    Vendor
    Lenovo
    Product
    N42 Chromebook
    Vendor
    Lenovo
    Product
    Thinkcentre Chromebox
    Vendor
    Lenovo
    Product
    Thinkpad 11e Chromebook
    Vendor
    Lenovo
    Product
    Thinkpad 13 Chromebook
    Vendor
    Lg
    Product
    Chromebase 22cb25s
    Vendor
    Lg
    Product
    Chromebase 22cv241
    Vendor
    Medion
    Product
    Akoya S2013
    Vendor
    Medion
    Product
    Chromebook S2015
    Vendor
    Mercer
    Product
    Chromebook
    Vendor
    Mercer
    Product
    V2 Chromebook
    Vendor
    Ncomputing
    Product
    Chromebook Cx100
    Vendor
    Nexian
    Product
    Chromebook
    Vendor
    Pcmerge
    Product
    Chromebook Pcm-116t-432b
    Vendor
    Poin2
    Product
    Chromebook 11
    Vendor
    Poin2
    Product
    Chromebook 14
    Vendor
    Positivo
    Product
    Chromebook Ch1190
    Vendor
    Prowise
    Product
    Entry Line Chromebook
    Vendor
    Prowise
    Product
    Proline Chromebook
    Vendor
    Rgs
    Product
    Education Chromebook
    Vendor
    Samsung
    Product
    Chromebook 2 11
    Vendor
    Samsung
    Product
    Chromebook 2 11 Xe500c12
    Vendor
    Samsung
    Product
    Chromebook 2 13
    Vendor
    Samsung
    Product
    Chromebook 3
    Vendor
    Samsung
    Product
    Chromebook Plus
    Vendor
    Samsung
    Product
    Chromebook Pro
    Vendor
    Sector-five
    Product
    E1 Rugged Chromebook
    Vendor
    Senkatel
    Product
    C1101 Chromebook
    Vendor
    Toshiba
    Product
    Chromebook
    Vendor
    Toshiba
    Product
    Chromebook 2
    Vendor
    True
    Product
    Idc Chromebook
    Vendor
    True
    Product
    Idc Chromebook 11
    Vendor
    Videonet
    Product
    Chromebook
    Vendor
    Videonet
    Product
    Chromebook Bl10
    Vendor
    Viglen
    Product
    Chromebook 11
    Vendor
    Viglen
    Product
    Chromebook 360
    Vendor
    Xolo
    Product
    Chromebook

    Exploits

    https://github.com/0xxon/rocahttps://github.com/0xxon/zeek-plugin-rocahttps://github.com/Elbarbons/ROCA-attack-on-vulnerability-CVE-2017-15361https://github.com/lva/Infineon-CVE-2017-15361https://github.com/nsacyber/Detect-CVE-2017-15361-TPMhttps://github.com/titanous/rocacheck

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://support.lenovo.com/us/en/product_security/LEN-15552
    http://www.securityfocus.com/bid/101484
    https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/
    https://blog.cr.yp.to/20171105-infineon.html
    https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf
    https://crocs.fi.muni.cz/public/papers/rsa_ccs17
    https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/
    https://github.com/crocs-muni/roca
    https://github.com/iadgov/Detect-CVE-2017-15361-TPM
    https://ics-cert.us-cert.gov/advisories/ICSA-18-058-01
    https://keychest.net/roca
    https://monitor.certipath.com/rsatest
    https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012
    https://security.netapp.com/advisory/ntap-20171024-0001/
    https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update
    https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03789en_us
    https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03801en_us
    https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160
    https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html
    https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html
    https://www.kb.cert.org/vuls/id/307015
    https://www.yubico.com/support/security-advisories/ysa-2017-01/
    http://support.lenovo.com/us/en/product_security/LEN-15552
    http://www.securityfocus.com/bid/101484
    https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/
    https://blog.cr.yp.to/20171105-infineon.html
    https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf
    https://crocs.fi.muni.cz/public/papers/rsa_ccs17
    https://dan.enigmabridge.com/roca-vulnerability-impact-on-gemalto-idprime-net-smart-cards/
    https://github.com/crocs-muni/roca
    https://github.com/iadgov/Detect-CVE-2017-15361-TPM
    https://ics-cert.us-cert.gov/advisories/ICSA-18-058-01
    https://keychest.net/roca
    https://monitor.certipath.com/rsatest
    https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV170012
    https://security.netapp.com/advisory/ntap-20171024-0001/
    https://sites.google.com/a/chromium.org/dev/chromium-os/tpm_firmware_update
    https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03789en_us
    https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03801en_us
    https://www.infineon.com/cms/en/product/promopages/tpm-update/?redirId=59160
    https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00104.html
    https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html
    https://www.kb.cert.org/vuls/id/307015
    https://www.yubico.com/support/security-advisories/ysa-2017-01/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High