{"id":"CVE-2024-29039","aliases":["ALSA-2024:9424","AZL-43015","AZL-43021","CLSA-2025-1764614196","DEBIAN-CVE-2024-29039","EUVD-2024-26088","GHSA-8rjm-5f5f-h4q6","MGASA-2024-0170","OESA-2024-2081","OESA-2024-2082","OESA-2024-2083","RHSA-2024:9424","RLSA-2024:9424","SUSE-SU-2024:1636-1","SUSE-SU-2024:1636-2","SUSE-SU-2025:20151-1","UBUNTU-CVE-2024-29039","openSUSE-SU-2024:13926-1"],"status":"published","title":"Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00984,"percentile":0.62639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-807"],"published":"2024-05-09T02:40:29Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"tpm2-tools","fixed_in":["5.5.1-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"tpm2-tools","fixed_in":["4.3.2-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tools","fixed_in":["5.2-2.el9_1.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tpm2-tools","fixed_in":["5.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tpm2-tools","fixed_in":["5.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.2-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-2.el9_1.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4-1","5.6-1","5.7-1","5.8-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.1-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-6.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-5.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0-6.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tpm2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tpm2-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"tpm2-tools-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-4.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-150400.6.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"efivar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.3-2","4.0.1-1","4.1-1","4.1.1-1","4.1.1-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0-2","5.2-1","5.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4-1","5.6-1","5.6-1build1","5.6-1build3","5.6-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-1build1","5.7-1ubuntu1","5.7-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tpm2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7-1","5.7-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1.1"}]}],"bundled":2}],"products":[{"vendor":"tpm2-software","product":"tpm2-tools"},{"vendor":"tpm2-tools_project","product":"tpm2-tools"},{"vendor":"tpm2_software","product":"tpm2_tools"}],"references":[{"url":"https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9424","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29038","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29039","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278071","tags":["report"]},{"url":"https://bugzilla.redhat.com/2278075","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9424.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29039","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764614196.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29039.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29039","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0170.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278071","tags":["report"]},{"url":"https://vuldb.com/?id.262756","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278075","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29038","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2082","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2083","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9424.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29038","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29039","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9424","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241636-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223687","tags":["report"]},{"url":"https://bugzilla.suse.com/1223689","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29039","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241636-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223690","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29040","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-29039","tags":["report"]},{"url":"https://github.com/tpm2-software/tpm2-tools/commit/98599df9392a346216c5a059b8d35271286100bb","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-29039","title":"Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T15:48:25.623Z","modified":"2025-11-04T17:19:47.529Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-26088","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T15:48:25Z","modified":"2025-11-04T17:19:47Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:28.381167Z"}],"nvd":[{"id":"CVE-2024-29039","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T16:15:03.777Z","modified":"2026-06-17T07:22:18.267Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-29039","title":"Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T15:48:25.623Z","modified":"2026-10-28T02:31:04.354004915Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-29039","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T16:15:03.777Z","modified":"2026-11-02T12:02:05.293280162Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-2081","title":"tpm2-tools security update","description":"The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.\r\n\r\nSecurity Fix(es):\r\n\r\ntpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.(CVE-2024-29038)\r\n\r\ntpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)","status":"published","published":"2024-08-30T11:07:33Z","modified":"2026-08-18T01:18:35.144514408Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2082","title":"tpm2-tools security update","description":"The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.\r\n\r\nSecurity Fix(es):\r\n\r\ntpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.(CVE-2024-29038)\r\n\r\ntpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)","status":"published","published":"2024-08-30T11:07:33Z","modified":"2026-08-18T01:18:35.6724974Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2083","title":"tpm2-tools security update","description":"The package contains the code for the TPM (Trusted Platform Module) 2.0 tools based on tpm2-tss.\r\n\r\nSecurity Fix(es):\r\n\r\ntpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.(CVE-2024-29038)\r\n\r\ntpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)","status":"published","published":"2024-08-30T11:07:33Z","modified":"2026-08-18T01:18:35.863100255Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:9424","title":"Red Hat Security Advisory: tpm2-tools security update","status":"published","published":"2024-11-12T18:06:57Z","modified":"2026-06-26T11:20:19Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:9424","title":"Low: tpm2-tools security update","description":"The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.\n\nSecurity Fix(es):\n\n* tpm2-tools:  arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038)\n\n* tpm2-tools: pcr selection value is not compared with the attest (CVE-2024-29039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:43.608626Z","modified":"2025-10-09T06:18:56.216132Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-29039","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T16:15:00Z","modified":"2026-10-17T12:56:44.386199778Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:9424","title":"Low: tpm2-tools security update","description":"The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space.  \n\nSecurity Fix(es):  \n\n  * tpm2-tools: arbitrary quote data may go undetected by tpm2_checkquote (CVE-2024-29038)\n  * tpm2-tools: pcr selection value is not compared with the attest (CVE-2024-29039)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:52.909984827Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-43015","title":"CVE-2024-29039 affecting package tpm2-tools for versions less than 5.5.1-1","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T16:15:03Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-43021","title":"CVE-2024-29039 affecting package tpm2-tools for versions less than 4.3.2-2","description":"tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file.  As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.","status":"published","published":"2024-06-28T16:15:03Z","modified":"2026-04-21T04:30:51.069518Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CLSA-2025-1764614196","title":"tpm2-tools: Fix of CVE-2024-29039","description":"- CVE-2024-29039: add comparison of pcr selection to prevent misleading picture\n  of the TPM state","status":"published","published":"2025-12-01T20:49:03Z","modified":"2026-06-01T00:31:23.412821129Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"MGASA-2024-0170","title":"Updated tpm2-tools packages fixes security vulnerabilities","description":"A flaw was found in the tpm2-tools package. This issue occurs due to a\nmissing check whether the magic number in attest is equal to\nTPM2_GENERATED_VALUE, which can allow an attacker to generate arbitrary\nquote data that may not be detected by tpm2_checkquote (CVE-2024-29038).\nThe pcr selection which is passed with the --pcr parameter is not\ncompared with the attest. So it is possible to fake a valid attestation\n(CVE-2024-29039).\nA vulnerability classified as problematic was found in tpm2-tools. This\nvulnerability affects an unknown code of the file\ntools/misc/tpm2_checkquote.c of the component pcr Selection Value\nHandler. The manipulation with an unknown input leads to a comparison\nvulnerability. The product compares two entities in a security-relevant\ncontext, but the comparison is incorrect, which may lead to resultant\nweaknesses.\n","status":"published","published":"2024-05-09T02:40:29Z","modified":"2026-04-16T04:43:28.077236202Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13926-1","title":"tpm2.0-tools-5.7-1.1 on GA media","description":"These are all security issues fixed in the tpm2.0-tools-5.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:43.196812Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1636-1","title":"Security update for tpm2.0-tools","description":"This update for tpm2.0-tools fixes the following issues:\n\n- CVE-2024-29038: Fixed arbitrary quote data validation by tpm2_checkquote (bsc#1223687).\n- CVE-2024-29039: Fixed pcr selection value to be compared with the attest (bsc#1223689).\n","status":"published","published":"2024-05-14T09:37:26Z","modified":"2026-02-04T03:45:21.775822Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1636-2","title":"Security update for tpm2.0-tools","description":"This update for tpm2.0-tools fixes the following issues:\n\n- CVE-2024-29038: Fixed arbitrary quote data validation by tpm2_checkquote (bsc#1223687).\n- CVE-2024-29039: Fixed pcr selection value to be compared with the attest (bsc#1223689).\n","status":"published","published":"2024-05-14T09:37:38Z","modified":"2026-02-04T02:12:56.741344Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2025:20151-1","title":"Security update for tpm2.0-tools, tpm2-0-tss","description":"This update for tpm2.0-tools, tpm2-0-tss fixes the following issues:\n\ntpm2-0-tss:\n  Update to version 4.1:\n  + Security\n    - CVE-2024-29040: arbitrary quote data may go undetected by Fapi_VerifyQuote (bsc#1223690)\n\n  + Fixed\n    - fapi: Fix length check on FAPI auth callbacks\n    - mu: Correct error message for errors\n    - tss2-rc: fix unknown laer handler dropping bits.\n    - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).\n    - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.\n    - build: fix build fail after make clean.\n    - mu: Fix unneeded size check in TPM2B unmarshaling.\n    - fapi: Fix missing parameter encryption.\n    - build: Fix failed build with --disable-vendor.\n    - fapi: Fix flush of persistent handles.\n    - fapi: Fix test provisioning with template with self generated certificate disabled.\n    - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.\n    - fapi: Revert pcr extension for EV_NO_ACTION events.\n    - fapi: Fix strange error messages if nv, ext, or policy path does not exits.\n    - fapi: Fix segfault caused by wrong allocation of pcr policy.\n    - esys: Fix leak in Esys_EvictControl for persistent handles.\n    - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.\n    - esys: Add reference counting for Esys_TR_FromTPMPublic.\n    - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.\n    - fapi: fix usage of self signed certificates in TPM.\n    - fapi: Usage of self signed certificates.\n    - fapi: A segfault after the error handling of non existing keys.\n    - fapi: Fix several leaks.\n    - fapi: Fix error handling for policy execution.\n    - fapi: Fix usage of persistent handles (should not be flushed)\n    - fapi: Fix test provisioning with template (skip test without self generated certificate).\n    - fapi: Fix pcr extension for EV_NO_ACTION\n    - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile\n    - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set\n    - fapi: Fix read large system eventlog (\u003e UINT16_MAX).\n    - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)\n    - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.\n    - fapi: Fix possible null pointer dereferencing in Fapi_List.\n    - sys: Fix size check in Tss2_Sys_GetCapability.\n    - esys: Fix leak in Esys_TR_FromTPMPublic.\n    - esys: fix unchecked return value in esys crypto.\n    - fapi: Fix wrong usage of local variable in provisioning.\n    - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.\n    - fapi: Fix possible out of bound array access in IMA parser.\n    - tcti device: Fix possible unmarshalling from uninitialized variable.\n    - fapi: Fix error checking authorization of signing key.\n    - fapi: Fix cleanup of policy sessions.\n    - fapi: Eventlog H-CRTM events and different localities.\n    - fapi: Fix missing synchronization of quote and eventlog.\n    - faii: Fix invalid free in Fapi_Quote with empty eventlog.\n\n  + Added\n    - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.\n    - mbedtls: add sha512 hmac.\n    - fapi: Enable usage of external keys for Fapi_Encrypt.\n    - fapi: Support download of AMD certificates.\n    - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.\n    - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.\n    - rc: New TPM return codes added.\n    - fapi: Further Nuvoton certificates added.\n    - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.\n    - tcti: Add '/dev/tcm0' to default conf\n    - fapi: New Nuvoton certificates added.\n    - esys: Fix leak in Esys_TR_FromTPMPublic.\n\n  + Removed\n    - Testing on Ubuntu 18.04 as it's near EOL (May 2023).\n\n\ntpm2.0-tools:\n  Update to version 5.7:\n  + Security\n    - CVE-2024-29038: arbitrary quote data may go undetected by tpm2_checkquote (bsc#1223687)\n    - CVE-2024-29039: pcr selection value is not compared with the attest (bsc#1223689)\n  + Fixed\n    - Fix eventlog test\n    - Fix issues with reading NV indexes\n    - Fix context save error on tpm2_create\n    - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail\n    - when attempting to context save a flushed session.\n    - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.\n    - tpm2_send: fix EOF detection on input stream.\n    - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.\n    - tpm2_nvread: fix input handling no nv index.\n    - Auth file: Ensure 0-termination when reading auths from a file.\n    - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.\n    - cirrus.yml fix tss compilation with libtpms for FreeBSD.\n    - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.\n    - options: fix TCTI handling to avoid failures for commands that should work with no options.\n    - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.\n  + Added\n    - Add the possibility for autoflush (environment variable \"TPM2TOOLS_AUTOFLUSH\", or -R option)\n  + Removed\n    - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.\n    - tpm2_nvread: fix input handling no nv index.\n\n  - Update to version 5.6\n    + tpm2_eventlog:\n      * add H-CRTM event support\n      * add support of efivar versions less than 38\n      * Add support to check for efivar/efivar.h manually\n      * Minor formatting fixes\n      * tpm2_eventlog: add support for replay with different StartupLocality\n      * Fix pcr extension for EV_NO_ACTION\n      * Extend test of yaml string representation\n      * Use helper for printing a string dump\n      * Fix upper bound on unique data size\n      * Fix YAML string formatting\n    + tpm2_policy:\n      * Add support for parsing forward seal TPM values\n      * Use forward seal values in creating policies\n      * Move dgst_size in evaluate_populate_pcr_digests()\n      * Allow more than 8 PCRs for sealing\n      * Move dgst_size in evaluate_populate_pcr_digests\n      * Allow more than 8 PCRs for sealing\n      * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more PCRs\n    + tpm2_encryptdecrypt: Fix pkcs7 padding stripping\n    + tpm2_duplicate:\n      * Support -a option for attributes\n      * Add --key-algorithm option\n    + tpm2_encodeobject: Use the correct -O option instead of -C\n    + tpm2_unseal: Add qualifier static to enhance the privacy of unseal\n      function\n    + tpm2_sign:\n      * Remove -m option which was added mistakenly\n      * Revert sm2 sign and verifysignature\n    + tpm2_createek:\n      * Correct man page example\n      * Fix usage of nonce\n      * Fix integrating nonce\n    + tpm2_clear: add more details about the action\n    + tpm2_startauthsession: allow the file attribute for policy\n      authorization.\n    + tpm2_getekcertificate: Add AMD EK support\n    + tpm2_ecdhzgen: Add public-key parameter\n    + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure\n    + Bug-fixes:\n      * The readthedocs build failed with module 'jinja2' has no\n        attribute 'contextfilter' a requirement file was added to fix\n        this problem\n      * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa\n        implementation. This error can be avoided by switching off the\n        optimization with pragma\n      * Changed wrong function name of \"Esys_Load\" to \"Esys_Load\"\n      * Function names beginning with Esys_ are wrongly written as Eys_\n      * Reading and writing a serialized persistent ESYS_TR handles\n      * cirrus-ci update image-family to freebsd-13-2 from 13-1\n    + misc:\n      * Change the default Python version to Python3 in the helper's code\n      * Skip test which uses the sign operator for comparison in\n        abrmd_policynv.sh\n      * tools/tr_encode: Add a tool that can encode serialized ESYS_TR\n        for persistent handles from the TPM2B_PUBLIC and the raw\n        persistent TPM2_HANDLE\n      * Add safe directory in config\n","status":"published","published":"2025-03-18T10:58:34Z","modified":"2026-03-23T04:48:52.943979Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}