Detect Trusted Platform Modules Vulnerable to CVE-2017-15361

This repository provides content for aiding DoD administrators in detecting systems that have an enabled Trusted Platform Module (TPM) that is vulnerable to CVE-2017-15361 and is a companion to Information Assurance Advisory RSA Key Generation Vulnerability Affecting Trusted Platform Modules. The files in this repository can be downloaded as a zip file here.

The main files of interest in the repository include:

windows/Detect-CVE-2017-15361-TPM.audit - a custom Nessus audit file useful for DoD administrators who want to scan Windows systems on their network with Nessus (acquire via the ACAS program). TPM 1.2 and TPM 2.0 devices are supported.
windows/Detect-CVE-2017-15361-TPM.ps1 - a PowerShell script useful for DoD administrators who want to locally test a single, standalone system. TPM 1.2 and TPM 2.0 devices are supported.
linux/Detect-CVE-2017-15361-TPM.audit - a custom Nessus audit file useful for DoD administrators who want to scan Linux systems on their network with Nessus (acquire via the ACAS program). Only TPM 1.2 devices are supported.
linux/Detect-CVE-2017-15361-TPM.sh - a bash script useful for DoD users who want to locally test a single, standalone Linux system. Only TPM 1.2 devices are supported.

Support files in the repository include:

GenerateWindowsNessusAuditFile.ps1 - a PowerShell script that generates the Detect-CVE-2017-15361-TPM.audit file for Windows based on code in the Detect-CVE-2017-15361-TPM.ps1 file.

Infineon TPM firmware versions affected:

4.0 - 4.33
4.4 - 4.42
5.0 - 5.61
6.0 - 6.42
7.0 - 7.61
133.0 - 133.32
149.0 - 149.32

License

See LICENSE.

Disclaimer

See DISCLAIMER.

detect-cve-2017-15361-tpm's Issues

Add TPM 2.0 support for Linux systems

/sys/class/tpm/tpm0/device/caps doesn't exist for TPM 2.0 in Linux-based systems. See tpm2-software/tpm2-tools#604 for more information.

We could try and detect if tpm2-tools is installed and then call tpm2_getcap -c="properties-fixed" if that returns the right data (manufacturer and firmware version). See https://github.com/tpm2-software/tpm2-tools/blob/master/man/tpm2_getcap.1.md for more information.

Looks like tpm2-tools 3.0+ uses tpm2_getcap. tpm2-tools 2.0 uses tpm2_dump_capability with the same arguments (ref https://manpages.debian.org/testing/tpm2-tools/tpm2_dump_capability.8.en.html). tpm2-tools 1.0 does not appear to have an equivalent command.

Wrong file on Linux?

The script is currently trying to read /sys/class/tpm/tpm0/device/cap. However, according to https://www.kernel.org/doc/Documentation/ABI/stable/sysfs-class-tpm, the file's name is actually caps.

Recommend Projects