CVE-2026-21444: 
NixOS vulnerability analysis and mitigation

CVE-2026-21444 is a cryptographic IV (initialization vector) handling flaw in libtpms, a library providing software emulation of a Trusted Platform Module (TPM). Affecting versions 0.10.0 and 0.10.1, the vulnerability arises from incorrect integration with OpenSSL 3.x: when certain symmetric ciphers are used, libtpms returns the initial IV to the caller instead of the updated (last) IV, weakening subsequent encryption and decryption operations. The flaw was discovered and disclosed on January 2, 2026, with version 0.10.2 released as the fix. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-330 (Use of Insufficiently Random Values). Specifically, the bug exists in src/tpm2/crypto/openssl/Helpers.c in the DoEVPGetIV function: the code used OSSL_PARAM_octet_ptr to retrieve the updated IV from OpenSSL 3.x's EVP cipher context, but this API allocates a new buffer and returns the IV into it without propagating the result back to the caller — effectively always returning the original IV. The fix replaces OSSL_PARAM_octet_ptr with OSSL_PARAM_octet_string, which writes the updated IV directly into the caller's buffer (GitHub Commit, GitHub Issue). Exploitation requires local access with low privileges, and the attack complexity is low since no special conditions beyond running affected libtpms versions with OpenSSL 3.x are needed (GitHub Advisory).

The primary impact is on data confidentiality: because the same initial IV is reused across multiple encryption/decryption operations instead of the correct updated IV, the cryptographic strength of symmetric cipher operations (e.g., AES-CBC) is significantly weakened. This IV reuse can enable a local authenticated attacker to recover or infer encrypted data protected by the TPM emulation layer. There is no impact on integrity or availability per the CVSS assessment, but systems relying on libtpms for TPM-backed key storage or encrypted communications face a practical risk of encrypted data recovery (GitHub Advisory, Red Hat).

A proof-of-concept demonstrating the bug is publicly available as a GitHub issue with a reproducible shell script using tpm2-tools commands (tpm2_encryptdecrypt) that shows the returned IV is identical to the input IV rather than updated (GitHub Issue). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is extremely low at 0.000030, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat).

1. Identify vulnerable environment: Confirm the target system is running libtpms version 0.10.0 or 0.10.1 linked against OpenSSL 3.x, typically in a virtualization or TPM emulation context (e.g., swtpm).
2. Set up TPM emulation: Connect to the software TPM using a TCTI such as export TPM2TOOLS_TCTI="swtpm:port=2321" and initialize it with tpm2_startup -c.
3. Load a symmetric key: Generate a random AES key and load it into the TPM emulator: dd if=/dev/urandom bs=1 count=16 of=sym.key && tpm2_loadexternal -r sym.key -G aes -c aes_key.ctx.
4. Perform encryption and capture IVs: Generate an initial IV and perform an encrypt/decrypt operation: dd if=/dev/urandom bs=1 count=16 of=iv.bin && tpm2_encryptdecrypt -c aes_key.ctx -o secret.enc secret.data -t iv.bin:newiv.bin.
5. Confirm IV reuse: Compare iv.bin and newiv.bin — on vulnerable versions they will be identical, confirming the bug. This IV reuse enables cryptanalytic attacks (e.g., chosen-plaintext or known-plaintext attacks) against subsequent ciphertext blocks encrypted with the same key and IV (GitHub Issue, GitHub Advisory).

• File System: Presence of libtpms shared library versions 0.10.0 or 0.10.1 (e.g., libtpms.so.0.10.0, libtpms.so.0.10.1) on the system; verify with rpm -q libtpms or dpkg -l libtpms.
• Process: Processes using swtpm or other TPM emulators linked against the vulnerable libtpms version; check with lsof | grep libtpms or ldconfig -p | grep libtpms.
• Logs: Repeated AES encrypt/decrypt operations via TPM emulation where the returned IV in application logs matches the input IV, indicating the bug is present and potentially being exploited.

Upgrade libtpms to version 0.10.2 or later, which contains the fix for the incorrect IV retrieval (GitHub Advisory). No configuration-based workarounds are available — patching is the only remediation option. Distribution-specific updates are available for Fedora, SUSE/openSUSE, and other Linux distributions; users should apply the relevant package update through their package manager (e.g., dnf update libtpms on Fedora, zypper update libtpms on SUSE) (Red Hat Bugzilla).

The vulnerability was reported and fixed by Stefan Berger, the primary maintainer of libtpms, who opened the bug report himself on December 29, 2025, and published the security advisory on January 2, 2026 (GitHub Issue, GitHub Advisory). Red Hat tracked the issue via Bugzilla and rated it medium severity, and multiple Linux distributions including Fedora and SUSE issued security updates for their libtpms packages (Red Hat Bugzilla). No significant broader media coverage or notable social media discussion beyond standard vulnerability tracking has been observed.