An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers, with CryptoLib through v2.9. It allows attackers to extract the ECDSA private key after extensive physical access (and consequently produce a clone). This was demonstrated on the Google Titan Security Key, based on an NXP A7005a chip. Other FIDO U2F security keys are also impacted (Yubico YubiKey Neo and Feitian K9, K13, K21, and K40) as well as several NXP JavaCard smartcards (J3A081, J2A081, J3A041, J3D145_M59, J2D145_M59, J3D120_M60, J3D082_M60, J2D120_M60, J2D082_M60, J3D081_M59, J2D081_M59, J3D081_M61, J2D081_M61, J3D081_M59_DF, J3D081_M61_DF, J3E081_M64, J3E081_M66, J2E081_M64, J3E041_M66, J3E016_M66, J3E016_M64, J3E041_M64, J3E145_M64, J3E120_M65, J3E082_M65, J2E145_M64, J2E120_M65, J2E082_M65, J3E081_M64_DF, J3E081_M66_DF, J3E041_M66_DF, J3E016_M66_DF, J3E041_M64_DF, and J3E016_M64_DF).
References
| Link | Resource |
|---|---|
| https://ninjalab.io/a-side-journey-to-titan/ | Third Party Advisory |
| https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf | Exploit Technical Description Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Feb 2024, 21:20
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-670 |
20 Jul 2023, 18:53
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:nxp:smartmx2_p60:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:smartmx3_p71d321:-:*:*:*:*:*:*:* |
20 Jan 2021, 16:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://ninjalab.io/a-side-journey-to-titan/ - Third Party Advisory | |
| References | (MISC) https://ninjalab.io/wp-content/uploads/2021/01/a_side_journey_to_titan.pdf - Exploit, Technical Description, Third Party Advisory | |
| CPE | cpe:2.3:h:nxp:j2e145_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:p5040:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e041_m66:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d081_m61:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e081_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e145_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:smartmx3_p71d321:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e041_m66_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2d082_m60:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2e081_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d081_m61_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d145_m59:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d120_m60:-:*:*:*:*:*:*:* cpe:2.3:h:ftsafe:k9:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:a7005a:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d082_m60:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2d081_m59:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2e120_m65:-:*:*:*:*:*:*:* cpe:2.3:h:google:titan_security_key:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e016_m66:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2d081_m61:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e081_m64_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e081_m66_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2d145_m59:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:p5010:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e081_m66:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e120_m65:-:*:*:*:*:*:*:* cpe:2.3:h:yubico:yubikey_neo:-:*:*:*:*:*:*:* cpe:2.3:h:ftsafe:k21:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e016_m66_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e016_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e041_m64_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e082_m65:-:*:*:*:*:*:*:* cpe:2.3:h:ftsafe:k40:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:3a081:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2e082_m65:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:smartmx3_p71d320:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e041_m64:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:p5021:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d081_m59:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3e016_m64_df:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:smartmx2_p60:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2a081:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3a041:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:p5020:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j3d081_m59_df:-:*:*:*:*:*:*:* cpe:2.3:h:ftsafe:k13:-:*:*:*:*:*:*:* cpe:2.3:h:nxp:j2d120_m60:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 1.9
v3 : 4.2 |
| CWE | CWE-203 |
07 Jan 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-01-07 16:15
Updated : 2024-02-15 21:20
NVD link : CVE-2021-3011
Mitre link : CVE-2021-3011
CVE.ORG link : CVE-2021-3011
JSON object : View
Products Affected
nxp
- j3d145_m59
- j3e081_m64_df
- j3e016_m64
- a7005a
- j3e120_m65
- j3d081_m59
- j2e120_m65
- j3e082_m65
- j3d081_m61_df
- j2e081_m64
- j3e041_m66_df
- j3e016_m66
- j3e081_m64
- j3d081_m61
- p5020
- j2d082_m60
- p5040
- p5021
- j2d081_m59
- j3a041
- j3e016_m66_df
- j2e145_m64
- 3a081
- j3e145_m64
- j2a081
- j2d145_m59
- j3e081_m66_df
- j2d081_m61
- j3d120_m60
- j3d081_m59_df
- j3d082_m60
- j3e041_m64
- j3e041_m66
- p5010
- j3e081_m66
- j3e041_m64_df
- j2e082_m65
- j3e016_m64_df
- j2d120_m60
ftsafe
- k9
- k13
- k21
- k40
- titan_security_key
yubico
- yubikey_neo
CWE
CWE-670
Always-Incorrect Control Flow Implementation