Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state
Summary
Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state
Original description
The description as published by the source.
tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-29039 tpm2-tools
- Ubuntu UBUNTU-CVE-2024-29039 tpm2-tools
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org