CVE-2024-32482CWE-125CWE-367

Tillitis TKey Signer possible RAM disclosure vulnerability

Low · published April 23, 2024

CVSS v3.1
2.2
EPSS
0%
Percentile
1.5
In the wild
Unconfirmed
What it is

The Tillitis TKey signer device application is an ed25519 signing tool. A vulnerability has been found that makes it possible to disclose portions of the TKey’s data in RAM over the USB interface. To exploit the vulnerability an attacker needs to use a custom client application and to touch the TKey. No secret is disclosed. All client applications integrating tkey-device-signer should upgrade to version 1.0.0 to receive a fix. No known workarounds are available.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00115 · 1.5th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2024-04-23T17:38Z
EPSS history
Timeline
  • 23 APR 17:38Z
    Tillitis TKey Signer possible RAM disclosure vulnerability
    cvelistv5