Out-of-bounds Read in Tillitis Tkey-Device-Signer
CVE-2024-32482
The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.
Vulnerability class: Buffer Overflow
EPSS: 0.001 (1.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.2 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Tillitis Tkey-device-signer — versions < 1.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-32482?
- CVE-2024-32482 is a low-severity vulnerability in Tillitis Tkey-Device-Signer, classified under Out-of-bounds Read. CVSS score: 2.2/10. Published 2024-04-23.
- How severe is CVE-2024-32482?
- Low severity. CVSS v3 base score is 2.2 out of 10.