CVE-2021-3011 (CNNVD-202101-406)

MEDIUM
中文标题:
Fido U2f 安全漏洞
英文标题:
An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrol...
CVSS分数: 4.2
发布时间: 2021-01-07 15:07:18
漏洞类型: 其他
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Fido U2f是Fido组织的一个基于标准公钥密码学技术主要用于智能卡认证的身份认证协议。 Fido U2f 存在安全漏洞，该漏洞源于允许攻击者在广泛的物理访问后提取ECDSA私钥。以下产品及型号受到影响：Google Titan Security Key (all versions)、Yubico Yubikey Neo、Feitian FIDO NFC USB-A / K9、Feitian MultiPass FIDO / K13、Feitian ePass FIDO USB-C / K21、Feitian FIDO NFC USB-C / K40、NXP J3D081_M59_DF 和衍生产品、NXP J3A081 和衍生产品、NXP J2E081_M64 和衍生产品、NXP J3D145_M59 和衍生产品、NXP J3D081_M59 和衍生产品、NXP J3E145_M64 和衍生产品、NXP J3E081_M64_DF 和衍生产品。

英文描述:

An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).

CWE类型:
CWE-670
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
ftsafe k13 - - - cpe:2.3:h:ftsafe:k13:-:*:*:*:*:*:*:*
ftsafe k21 - - - cpe:2.3:h:ftsafe:k21:-:*:*:*:*:*:*:*
ftsafe k40 - - - cpe:2.3:h:ftsafe:k40:-:*:*:*:*:*:*:*
ftsafe k9 - - - cpe:2.3:h:ftsafe:k9:-:*:*:*:*:*:*:*
google titan_security_key - - - cpe:2.3:h:google:titan_security_key:-:*:*:*:*:*:*:*
nxp 3a081 - - - cpe:2.3:h:nxp:3a081:-:*:*:*:*:*:*:*
nxp a7005a - - - cpe:2.3:h:nxp:a7005a:-:*:*:*:*:*:*:*
nxp j2a081 - - - cpe:2.3:h:nxp:j2a081:-:*:*:*:*:*:*:*
nxp j2d081_m59 - - - cpe:2.3:h:nxp:j2d081_m59:-:*:*:*:*:*:*:*
nxp j2d081_m61 - - - cpe:2.3:h:nxp:j2d081_m61:-:*:*:*:*:*:*:*
nxp j2d082_m60 - - - cpe:2.3:h:nxp:j2d082_m60:-:*:*:*:*:*:*:*
nxp j2d120_m60 - - - cpe:2.3:h:nxp:j2d120_m60:-:*:*:*:*:*:*:*
nxp j2d145_m59 - - - cpe:2.3:h:nxp:j2d145_m59:-:*:*:*:*:*:*:*
nxp j2e081_m64 - - - cpe:2.3:h:nxp:j2e081_m64:-:*:*:*:*:*:*:*
nxp j2e082_m65 - - - cpe:2.3:h:nxp:j2e082_m65:-:*:*:*:*:*:*:*
nxp j2e120_m65 - - - cpe:2.3:h:nxp:j2e120_m65:-:*:*:*:*:*:*:*
nxp j2e145_m64 - - - cpe:2.3:h:nxp:j2e145_m64:-:*:*:*:*:*:*:*
nxp j3a041 - - - cpe:2.3:h:nxp:j3a041:-:*:*:*:*:*:*:*
nxp j3d081_m59 - - - cpe:2.3:h:nxp:j3d081_m59:-:*:*:*:*:*:*:*
nxp j3d081_m59_df - - - cpe:2.3:h:nxp:j3d081_m59_df:-:*:*:*:*:*:*:*
nxp j3d081_m61 - - - cpe:2.3:h:nxp:j3d081_m61:-:*:*:*:*:*:*:*
nxp j3d081_m61_df - - - cpe:2.3:h:nxp:j3d081_m61_df:-:*:*:*:*:*:*:*
nxp j3d082_m60 - - - cpe:2.3:h:nxp:j3d082_m60:-:*:*:*:*:*:*:*
nxp j3d120_m60 - - - cpe:2.3:h:nxp:j3d120_m60:-:*:*:*:*:*:*:*
nxp j3d145_m59 - - - cpe:2.3:h:nxp:j3d145_m59:-:*:*:*:*:*:*:*
nxp j3e016_m64 - - - cpe:2.3:h:nxp:j3e016_m64:-:*:*:*:*:*:*:*
nxp j3e016_m64_df - - - cpe:2.3:h:nxp:j3e016_m64_df:-:*:*:*:*:*:*:*
nxp j3e016_m66 - - - cpe:2.3:h:nxp:j3e016_m66:-:*:*:*:*:*:*:*
nxp j3e016_m66_df - - - cpe:2.3:h:nxp:j3e016_m66_df:-:*:*:*:*:*:*:*
nxp j3e041_m64 - - - cpe:2.3:h:nxp:j3e041_m64:-:*:*:*:*:*:*:*
nxp j3e041_m64_df - - - cpe:2.3:h:nxp:j3e041_m64_df:-:*:*:*:*:*:*:*
nxp j3e041_m66 - - - cpe:2.3:h:nxp:j3e041_m66:-:*:*:*:*:*:*:*
nxp j3e041_m66_df - - - cpe:2.3:h:nxp:j3e041_m66_df:-:*:*:*:*:*:*:*
nxp j3e081_m64 - - - cpe:2.3:h:nxp:j3e081_m64:-:*:*:*:*:*:*:*
nxp j3e081_m64_df - - - cpe:2.3:h:nxp:j3e081_m64_df:-:*:*:*:*:*:*:*
nxp j3e081_m66 - - - cpe:2.3:h:nxp:j3e081_m66:-:*:*:*:*:*:*:*
nxp j3e081_m66_df - - - cpe:2.3:h:nxp:j3e081_m66_df:-:*:*:*:*:*:*:*
nxp j3e082_m65 - - - cpe:2.3:h:nxp:j3e082_m65:-:*:*:*:*:*:*:*
nxp j3e120_m65 - - - cpe:2.3:h:nxp:j3e120_m65:-:*:*:*:*:*:*:*
nxp j3e145_m64 - - - cpe:2.3:h:nxp:j3e145_m64:-:*:*:*:*:*:*:*
nxp p5010 - - - cpe:2.3:h:nxp:p5010:-:*:*:*:*:*:*:*
nxp p5020 - - - cpe:2.3:h:nxp:p5020:-:*:*:*:*:*:*:*
nxp p5021 - - - cpe:2.3:h:nxp:p5021:-:*:*:*:*:*:*:*
nxp p5040 - - - cpe:2.3:h:nxp:p5040:-:*:*:*:*:*:*:*
yubico yubikey_neo - - - cpe:2.3:h:yubico:yubikey_neo:-:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
CVSS评分详情
4.2
MEDIUM
CVSS向量: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS版本: 3.1
机密性
HIGH
完整性
NONE
可用性
NONE
时间信息
发布时间:
2021-01-07 15:07:18
修改时间:
2024-08-03 16:45:50
创建时间:
2025-11-11 15:36:49
更新时间:
2025-11-11 15:56:35
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2021-3011 2025-11-11 15:21:04 2025-11-11 07:36:49
NVD nvd_CVE-2021-3011 2025-11-11 14:57:32 2025-11-11 07:45:08
CNNVD cnnvd_CNNVD-202101-406 2025-11-11 15:10:33 2025-11-11 07:56:35
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:56:35
vulnerability_type: 未提取 → 其他; cnnvd_id: 未提取 → CNNVD-202101-406; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 其他
  • cnnvd_id: 未提取 -> CNNVD-202101-406
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:45:08
cvss_score: 未提取 → 4.2; cvss_vector: NOT_EXTRACTED → CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N; cvss_version: NOT_EXTRACTED → 3.1; affected_products_count: 0 → 45; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • cvss_score: 未提取 -> 4.2
  • cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • cvss_version: NOT_EXTRACTED -> 3.1
  • affected_products_count: 0 -> 45
  • data_sources: ['cve'] -> ['cve', 'nvd']