CVE-2024-29039: Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state
The pcr selection which is passed with the --pcr parameter it not compared with the attest. So it's possible to fake a valid attestation.
References: https://github.com/tpm2-software/tpm2-tools/commit/98599df9392a346216c5a059b8d35271286100bb
Other sources
tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2checkquote outputs by altering the TPMLPCRSELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29039?
CVE-2024-29039 has a critical severity rating due to the possibility of faking valid attestations.
How do I fix CVE-2024-29039?
To fix CVE-2024-29039, upgrade to tpm2-tools version 5.7 or later.
What does the CVE-2024-29039 vulnerability affect?
CVE-2024-29039 affects the tpm2-tools package, specifically the --pcr parameter handling.
Can CVE-2024-29039 be exploited remotely?
Yes, CVE-2024-29039 can be exploited remotely, allowing attackers to fake attestation.
Is there a workaround for CVE-2024-29039?
There are no known workarounds for CVE-2024-29039; updating to the fixed version is recommended.