This vulnerability involves a timing side-channel in the RSA OAEP decryption process within TPM 2.0 devices. By measuring timing discrepancies during decryption operations, a privileged local attacker with access to the TPM command interface may extract sensitive cryptographic material, including import blobs, credential blobs, session salts, and potentially the RSA Endorsement Key. Exploitation could lead to decryption of ciphertexts intended to be protected by TPM-managed RSA keys and possibly allow forgery of TPM attestations. The Trusted Computing Group references this issue as TCGVRT0011. No CVSS score or remediation level has been published to date.

The vulnerability allows a privileged local attacker to leverage timing side-channels to recover sensitive cryptographic information protected by TPM 2.0 RSA keys, including the RSA Endorsement Key. This could compromise the confidentiality of encrypted data and potentially enable forgery of TPM attestations, undermining the trust model of TPM-based security. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation has been published by the Trusted Computing Group. Until a patch or guidance is available, restrict privileged local access to the TPM command interface to trusted users only.