CVE-2024-29039

The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.

Security Fix(es):

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This issue was patched in version 5.7.(CVE-2024-29038)

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)

The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.

Security Fix(es):

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This issue was patched in version 5.7.(CVE-2024-29038)

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)

The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.

Security Fix(es):

• tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038)

• tpm2-tools: pcr selection value is not compared with the attest (CVE-2024-29039)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.

Security Fix(es):

• tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038)
• tpm2-tools: pcr selection value is not compared with the attest (CVE-2024-29039)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

• CVE-2024-29039: add comparison of pcr selection to prevent misleading picture of the TPM state

A flaw was found in the tpm2-tools package. This issue occurs due to a missing check whether the magic number in attest is equal to TPM2_GENERATED_VALUE, which can allow an attacker to generate arbitrary quote data that may not be detected by tpm2_checkquote (CVE-2024-29038). The pcr selection which is passed with the --pcr parameter is not compared with the attest. So it is possible to fake a valid attestation (CVE-2024-29039). A vulnerability classified as problematic was found in tpm2-tools. This vulnerability affects an unknown code of the file tools/misc/tpm2_checkquote.c of the component pcr Selection Value Handler. The manipulation with an unknown input leads to a comparison vulnerability. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

These are all security issues fixed in the tpm2.0-tools-5.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for tpm2.0-tools fixes the following issues:

• CVE-2024-29038: Fixed arbitrary quote data validation by tpm2_checkquote (bsc#1223687).
• CVE-2024-29039: Fixed pcr selection value to be compared with the attest (bsc#1223689).

This update for tpm2.0-tools fixes the following issues:

• CVE-2024-29038: Fixed arbitrary quote data validation by tpm2_checkquote (bsc#1223687).
• CVE-2024-29039: Fixed pcr selection value to be compared with the attest (bsc#1223689).

This update for tpm2.0-tools, tpm2-0-tss fixes the following issues:

tpm2-0-tss: Update to version 4.1:

• Security

  • CVE-2024-29040: arbitrary quote data may go undetected by Fapi_VerifyQuote (bsc#1223690)

• Fixed

  • fapi: Fix length check on FAPI auth callbacks
  • mu: Correct error message for errors
  • tss2-rc: fix unknown laer handler dropping bits.
  • fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  • fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  • build: fix build fail after make clean.
  • mu: Fix unneeded size check in TPM2B unmarshaling.
  • fapi: Fix missing parameter encryption.
  • build: Fix failed build with --disable-vendor.
  • fapi: Fix flush of persistent handles.
  • fapi: Fix test provisioning with template with self generated certificate disabled.
  • fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  • fapi: Revert pcr extension for EV_NO_ACTION events.
  • fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  • fapi: Fix segfault caused by wrong allocation of pcr policy.
  • esys: Fix leak in Esys_EvictControl for persistent handles.
  • tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  • esys: Add reference counting for Esys_TR_FromTPMPublic.
  • esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  • fapi: fix usage of self signed certificates in TPM.
  • fapi: Usage of self signed certificates.
  • fapi: A segfault after the error handling of non existing keys.
  • fapi: Fix several leaks.
  • fapi: Fix error handling for policy execution.
  • fapi: Fix usage of persistent handles (should not be flushed)
  • fapi: Fix test provisioning with template (skip test without self generated certificate).
  • fapi: Fix pcr extension for EV_NO_ACTION
  • test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  • tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  • fapi: Fix read large system eventlog (> UINT16_MAX).
  • esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  • test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  • fapi: Fix possible null pointer dereferencing in Fapi_List.
  • sys: Fix size check in Tss2_Sys_GetCapability.
  • esys: Fix leak in Esys_TR_FromTPMPublic.
  • esys: fix unchecked return value in esys crypto.
  • fapi: Fix wrong usage of local variable in provisioning.
  • fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  • fapi: Fix possible out of bound array access in IMA parser.
  • tcti device: Fix possible unmarshalling from uninitialized variable.
  • fapi: Fix error checking authorization of signing key.
  • fapi: Fix cleanup of policy sessions.
  • fapi: Eventlog H-CRTM events and different localities.
  • fapi: Fix missing synchronization of quote and eventlog.
  • faii: Fix invalid free in Fapi_Quote with empty eventlog.

• Added

  • tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  • mbedtls: add sha512 hmac.
  • fapi: Enable usage of external keys for Fapi_Encrypt.
  • fapi: Support download of AMD certificates.
  • tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  • fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  • rc: New TPM return codes added.
  • fapi: Further Nuvoton certificates added.
  • tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  • tcti: Add '/dev/tcm0' to default conf
  • fapi: New Nuvoton certificates added.
  • esys: Fix leak in Esys_TR_FromTPMPublic.

• Removed

  • Testing on Ubuntu 18.04 as it's near EOL (May 2023).

tpm2.0-tools: Update to version 5.7:

• Security
  • CVE-2024-29038: arbitrary quote data may go undetected by tpm2_checkquote…