BYPASSING DISK ENCRYPTION ON SYSTEMS WITH AUTOMATIC TPM2 UNLOCK

Summary from the TLDR InfoSec newsletter

There is a significant security vulnerability in TPM2-based disk encryption systems where an attacker with brief physical access can bypass disk encryption on machines using systemd-cryptenroll or clevis without a PIN. The vulnerability exists because most TPM2 unlock setups fail to verify the LUKS identity of the decrypted partition, allowing attackers to create a malicious partition that can extract the original encryption key while maintaining the TPM state. This post demonstrates successful attacks on both Fedora and NixOS systems. It recommends either using a TPM PIN or implementing proper PCR 15 verification as mitigation strategies, though it notes that the latter is not easily available on most distributions.