CVE-2021-3565

CVE-2021-3565 describes a flaw in tpm2-tools versions prior to 5.1.1 and 4.3.2, where the tpm2_import utility used a fixed AES key for its inner wrapper. This vulnerability primarily affects tpm2-tools, Red Hat Enterprise Linux, and Fedora, potentially allowing a Man-in-the-Middle (MITM) attacker to decrypt sensitive key material during import. Rated as MEDIUM severity with a CVSS score of 5.9, the vulnerability has a network attack vector and high attack complexity, as it requires a MITM position. The primary impact is a high risk to data confidentiality, as an attacker could reveal imported keys. There is currently no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.