CVE-2016-6129 in LibTomCrypt
Summary
by MITRE
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 06/05/2026
The vulnerability identified as CVE-2016-6129 resides within the LibTomCrypt cryptographic library implementation used in OP-TEE security framework prior to version 2.2.0. This flaw specifically affects the rsa_verify_hash_ex function located in rsa_verify_hash.c, creating a critical security gap that enables remote attackers to exploit signature forgery mechanisms. The core issue stems from insufficient validation of message length parameters during RSA signature verification processes, particularly concerning the mismatch between actual message length and ASN.1 encoded data length requirements.
The technical flaw manifests through a failure in cryptographic protocol enforcement where the verification function does not properly check that the message length matches the expected ASN.1 encoded data length during signature validation. This validation gap creates an opportunity for attackers to manipulate signature parameters and construct forged RSA signatures that appear legitimate to the verification system. The vulnerability directly enables a Bleichenbacher signature forgery attack, which exploits weaknesses in RSA signature schemes by leveraging improper length validation mechanisms. This attack vector specifically targets the padding validation process in RSA signatures, allowing malicious actors to generate valid-looking signatures without possessing the private key.
The operational impact of this vulnerability extends beyond simple signature forgery to potentially compromise the entire security architecture of systems relying on OP-TEE for secure operations. Remote attackers can leverage this flaw to forge public certificates, undermining the integrity of the certificate chain and enabling man-in-the-middle attacks. The vulnerability affects systems implementing RSA signature verification where proper length validation is bypassed, potentially allowing attackers to impersonate legitimate entities, modify secure communications, or gain unauthorized access to protected resources. This weakness particularly impacts IoT devices and embedded systems that depend on OP-TEE for secure key management and cryptographic operations.
Mitigation strategies for CVE-2016-6129 require immediate deployment of OP-TEE version 2.2.0 or later, which includes proper message length validation in the rsa_verify_hash_ex function. Organizations should also implement additional security controls such as monitoring for anomalous signature patterns and conducting regular cryptographic audits to detect potential exploitation attempts. The fix addresses the underlying CWE-20 issue related to input validation by ensuring proper length parameter checking before cryptographic operations. Security teams should also consider implementing the ATT&CK technique T1552.001 for credential access prevention, as this vulnerability could enable unauthorized access to secure systems through forged authentication tokens. Regular updates to cryptographic libraries and comprehensive security testing of cryptographic implementations remain essential practices to prevent similar vulnerabilities from compromising system integrity.