Timing Side-Channel in TCG TPM 2.0 Reference Code RSA-OAEP Decryption
CVSS 3.1
5.9medium
EPSS
<1%p10
Published
()
Modified
AI analysis
CVE-2026-6727 is a timing side-channel vulnerability (CWE-208, tracked as TCGVRT0011) in the RSA OAEP decryption implementation of TPM 2.0 code derived from the Trusted Computing Group reference implementation. A privileged local attacker with access to the TPM command interface can measure timing differences across decryption operations to recover information sufficient to decrypt ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, the leaked information may also enable forgery of TPM 2.0 attestations, undermining trust in remote-attestation results. Any platform whose TPM 2.0 firmware is built from the affected TCG reference code is potentially affected, which spans TPM silicon from multiple vendors shipped across modern PCs, laptops, and servers; per-vendor exposure depends on whether the vulnerable code path was adopted. No public proof-of-concept or known exploitation exists (EPSS 0.2% over 30 days, not in CISA KEV).
What to do: Inventory devices by TPM vendor/model and monitor for TPM firmware or driver fixes tied to TCGVRT0011 and VU#431093; apply updates from the device or silicon vendor as they are released, potentially surfacing through OS patch channels such as Microsoft's August 2026 Patch Tuesday. Until patched, restrict local privileged access to the TPM command interface to trusted code and weigh the risk of relying on TPM attestation for high-assurance operations. With no known exploitation and a high-complexity, local attack requirement, treat this as standard patch-cycle priority rather than an emergency.
Affected
Trusted Computing Group TPM 2.0 reference code (TCGVRT0011 / VU#431093)
—
TPM 2.0 implementations built from the TCG reference code
—
Estimated exposure
mass≈100M+ devices (TPM 2.0 chips ship as standard in modern PCs, laptops, and servers; confirmed per-vendor counts unknown) — TPM 2.0 is a de facto standard on contemporary PCs and servers and most TPM silicon vendors build on the TCG reference code, so even a conservative subset of the installed base exceeds the mass threshold, although published counts of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
Tenable reports Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including three zero-days, one exploited in the wild (CVE-2026-68820).
Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 important, and one moderate, and three zero-days among them. One zero-day is confirmed as exploited in the wild. The release covers components including .NET, .NET Framework, Active Directory Certificate Services (AD CS), Azure services, and Windows. Tenable's count omits two CVEs assigned by MITRE, CVE-2026-6726 and CVE-2026-6727.
CERT/CC discloses two TPM 2.0 reference code flaws allowing RSA key decryption and forged TPM attestations via crafted commands.
CERT/CC published VU#431093 covering two vulnerabilities in the TCG TPM 2.0 reference implementation: CVE-2026-6726 (information leakage via falsified TPM keys) and CVE-2026-6727 (timing side-channel in RSA OAEP decryption). An attacker with privileged access to a TPM command interface could send crafted TPM commands to decrypt ciphertexts for affected TPM-managed RSA keys, including the RSA Endorsement Key, or obtain credentials enabling forged TPM 2.0 attestations. Remediation is tracked in TCGVRT010 and TCGVRT0011.