Microsoft issues advisory for Surface Pro 3 TPM bypass vulnerability

guest · Oct 19, 2021

Microsoft issues advisory for Surface Pro 3 TPM bypass vulnerability
October 19, 2021
https://www.bleepingcomputer.com/ne...y-for-surface-pro-3-tpm-bypass-vulnerability/

Microsoft has published an advisory regarding a security feature bypass vulnerability impacting Surface Pro 3 tablets which could allow threat actors to introduce malicious devices within enterprise environments.

The security flaw tracked as CVE-2021-42299 can be exploited in high complexity attacks dubbed TPM Carte Blanche by Google security researchers who discovered them and shared additional details on Monday.
To successfully abuse the bug, attackers would either need access to the owner's credentials or physical access to the device.
Click to expand...

By exploiting CVE-2021-42299, attackers can poison the TPM and PCR logs to obtain false attestations, allowing them to compromise the Device Health Attestation validation process.

"Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. Windows uses these PCR measurements to determine device health," Microsoft explains.
"A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Register (PCR) banks."
Click to expand...

"The attacker can prepare a bootable Linux USB stick to minimize the interactions required with the target device (e.g., as an Evil Maid attack)," added Chris Fenner, the Google software engineer who found the bug.

Fenner also published proof-of-concept (Poc) exploit code demonstrating how the flaw could be exploited on Monday.
Click to expand...

"It is possible that other devices, including non-Microsoft devices, using a similar BIOS may also be vulnerable," Microsoft said.
Click to expand...

Log in or Sign up

Microsoft issues advisory for Surface Pro 3 TPM bypass vulnerability

guest Guest

Log in or Sign up

Microsoft issues advisory for Surface Pro 3 TPM bypass vulnerability

guest Guest

Useful Searches