Cyloq

A missing required cryptographic step exists in the embedded Linux firmware. This issue is an incomplete remediation of a previous flaw where TPM2 parameter encryption was introduced as a countermeasure. Due to an omission in the authorization session configuration, the parameter encryption is ineffective. An attacker with invasive physical access can capture TPM communications on the SPI bus to derive the LUKS disk encryption key in plaintext, leading to a full compromise of the encrypted disk volume. Remote exploitation is not possible.

A physical attack is possible on certain Moxa industrial computers utilizing TPM-backed LUKS full-disk encryption. The discrete TPM is connected to the CPU via an SPI bus. Successful exploitation requires invasive physical access, including opening the device and connecting external equipment to the SPI bus to capture TPM communications. If successful, the captured data may allow offline decryption of the eMMC contents. This attack requires extended physical access, possession of the device, appropriate equipment, and sufficient time for signal capture and analysis. Remote exploitation is not possible. The attack involves capturing TPM communications via the SPI bus. LUKS (Linux Unified Key Setup) is a disk encryption specification. eMMC (embedded MultiMediaCard) is a type of flash memory used in many embedded systems.

Moxa Arm-based industrial computers running Moxa Industrial Linux Secure utilize a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation, as the bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. This prevents the installation of malicious firmware or execution of arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible.