CVE-2020-27208 Security feature bypass in n/a
Attackers can bypass read-out protection during initialization to extract private keys from FIDO2 security tokens via the debug interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27208?
CVE-2020-27208 is a medium-severity vulnerability in n/a, published on 21 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the Nitrokey FIDO2 token. This allows an adversary to downgrade the RDP level and access secrets such as private ECC keys from SRAM via the debug interface.
Weakness: CWE-326
Which versions are affected by CVE-2020-27208?
It affects 3 products.
Linux distribution packages (4)
solo SUSE:Package Hub 15 SP2 | All versions | 4.1.2-bp153.2.3.1 |
solo SUSE:Package Hub 15 SP3 | All versions | 4.1.2-bp153.2.3.1 |
solo openSUSE:Leap 15.2 | All versions | 4.1.2-bp153.2.3.1 |
solo openSUSE:Leap 15.3 | All versions | 4.1.2-bp153.2.3.1 |
Products include Nitrokey Fido2 Firmware, Solokeys Solo Firmware, Solokeys Somu Firmware.
How do I fix CVE-2020-27208?
Apply the vendor's patch.
Is CVE-2020-27208 being exploited?
There is no known exploitation of CVE-2020-27208 in the wild and no public exploit code.
Sources
Also known as GHSA-m4fc-4f5m-5hhw, openSUSE-SU-2021:1019-1.