CVEvulnerability

CVE-2021-3011

4.2 MEDIUM Published 2021-01-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-01-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.2 MEDIUM — CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-670

Description

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).

Affected configurations

• ftsafe k13 • ftsafe k21 • ftsafe k40 • ftsafe k9 • google titan security key • nxp 3a081 • nxp a7005a • nxp j2a081 • nxp j2d081 m59 • nxp j2d081 m61 • nxp j2d082 m60 • nxp j2d120 m60 • nxp j2d145 m59 • nxp j2e081 m64 • nxp j2e082 m65 • nxp j2e120 m65 • nxp j2e145 m64 • nxp j3a041 • nxp j3d081 m59 • nxp j3d081 m59 df • nxp j3d081 m61 • nxp j3d081 m61 df • nxp j3d082 m60 • nxp j3d120 m60 • nxp j3d145 m59 • nxp j3e016 m64 • nxp j3e016 m64 df • nxp j3e016 m66 • nxp j3e016 m66 df • nxp j3e041 m64 • nxp j3e041 m64 df • nxp j3e041 m66 • nxp j3e041 m66 df • nxp j3e081 m64 • nxp j3e081 m64 df • nxp j3e081 m66 • nxp j3e081 m66 df • nxp j3e082 m65 • nxp j3e120 m65 • nxp j3e145 m64 • nxp p5010 • nxp p5020 • nxp p5021 • nxp p5040 • yubico yubikey neo

Related

Weakness · CWE (1)

  • CWE-670 Always-Incorrect Control Flow Implementation weakness

Referenced by CWE · observed example (4)

  • CWE-1262 Improper Access Control for Register Interface weakness
  • CWE-1300 Improper Protection of Physical Side Channels weakness
  • CWE-670 Always-Incorrect Control Flow Implementation weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References