{"id":"CVE-2024-29040","aliases":["ALPINE-CVE-2024-29040","AZL-42978","AZL-42985","BELL-CVE-2024-29040","DEBIAN-CVE-2024-29040","EUVD-2024-26089","GHSA-837m-jw3m-h9p6","MGASA-2024-0171","OESA-2024-1613","OESA-2024-1637","OESA-2024-1638","SUSE-SU-2024:1605-1","SUSE-SU-2024:1635-1","SUSE-SU-2024:1635-2","SUSE-SU-2025:20151-1","UBUNTU-CVE-2024-29040","USN-6796-1","openSUSE-SU-2024:13933-1"],"status":"published","title":"Fapi Verify Quote: Does not detect if quote was not generated by TPM","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0033,"percentile":0.2637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2024-04-30T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"tpm2-tss","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"tpm2-tss","fixed_in":["4.0.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"tpm2-tss","fixed_in":["2.4.6-4"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"tpm2-tss","fixed_in":["3.2.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"tpm2-tss","fixed_in":["4.1.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tpm2-tss","fixed_in":["4.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tpm2-tss","fixed_in":["4.1.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"tpm2-tss","fixed_in":["4.0.2-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"tpm2-tss","fixed_in":["3.0.3-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tpm2-tss","fixed_in":["3.1.0-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"tpm2-tss","fixed_in":["3.1.0-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"tpm2-tss","fixed_in":["3.1.0-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"tpm2-tss","fixed_in":["3.0.3-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"tpm2-tss","fixed_in":["3.1.0-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tpm2-0-tss","fixed_in":["3.1.0-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","fixed_in":["3.2.0-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"tpm2-tss","fixed_in":["4.0.1-7.1ubuntu5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-4"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-r0"},{"fixed":"3.2.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-r0"},{"fixed":"4.1.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-3","3.2.1-3+loong64","4.0.1-1","4.0.1-2","4.0.1-3","4.0.1-4","4.0.1-5","4.0.1-6","4.0.1-7","4.0.1-7.1","4.0.1-7.1~exp1","4.0.1-7.2","4.1.0-1","4.1.3-1","4.1.3-1.1","4.1.3-1.2","4.1.3-1.2+hurd.1","4.1.3-1.2+hurd.2","4.1.3-1.2+hurd.3","4.1.3-1.3","4.1.3-2","4.1.3-3","4.1.3-4","4.1.3-5","4.1.3-6","4.1.3-7","4.2.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"efivar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38-3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tpm2-0-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"tpm2.0-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1ubuntu1.1"}]}],"versions":["3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.1.0-3ubuntu1","3.2.0-0ubuntu2","3.2.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-7.1ubuntu5.1"}]}],"versions":["4.0.1-3ubuntu1","4.0.1-6ubuntu1","4.0.1-7ubuntu1","4.0.1-7.1ubuntu4","4.0.1-7.1ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1ubuntu0.20.04.2"}]}],"versions":["2.1.0-4","2.3.1-3","2.3.2-1","2.3.2-1ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0-1ubuntu1.1"}]}],"versions":["3.0.3-2ubuntu1","3.0.3-2ubuntu2","3.1.0-3ubuntu1","3.2.0-0ubuntu2","3.2.0-1ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tpm2-tss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-7.1ubuntu5.1"}]}],"versions":["4.0.1-3ubuntu1","4.0.1-6ubuntu1","4.0.1-7ubuntu1","4.0.1-7.1ubuntu4","4.0.1-7.1ubuntu5"],"bundled":2}],"products":[{"vendor":"tpm2-software","product":"tpm2-tss"},{"vendor":"tpm2_software_stack_project","product":"tpm2_software_stack"}],"references":[{"url":"https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-29040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29040","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-29040","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29040.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29040","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0171.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33176","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29040","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1613","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1637","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1638","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241605-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223690","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29040","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241635-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241635-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223687","tags":["report"]},{"url":"https://bugzilla.suse.com/1223689","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-29039","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-29040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29040","tags":["report"]},{"url":"https://github.com/tpm2-software/tpm2-tss/commit/710cd0b6adf3a063f34a8e92da46df7a107d9a99","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6796-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-22745","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-29040","title":"Fapi Verify Quote: Does not detect if quote was not generated by TPM","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:02:04.076Z","modified":"2025-11-04T17:19:50.283Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-26089","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:02:04Z","modified":"2025-11-04T17:19:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:28.381167Z"}],"nvd":[{"id":"CVE-2024-29040","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:15:02.773Z","modified":"2026-06-17T07:22:18.387Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"ALPINE-CVE-2024-29040","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:15:02.773Z","modified":"2026-11-03T06:32:45.45150743Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"BELL-CVE-2024-29040","status":"published","published":"2024-05-01T05:57:33.482357Z","modified":"2026-01-26T09:36:31.55183Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-29040","title":"Fapi Verify Quote: Does not detect if quote was not generated by TPM","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:02:04.076Z","modified":"2026-10-28T02:30:38.323029023Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-29040","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This  issue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:15:02.773Z","modified":"2026-11-02T12:02:04.989536859Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-1613","title":"tpm2-tss security update","description":"tpm2-tss is a software stack supporting Trusted Platform Module(TPM) 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote.(CVE-2024-29040)","status":"published","published":"2024-05-17T11:07:04Z","modified":"2026-08-18T01:18:26.786504567Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1637","title":"tpm2-tss security update","description":"tpm2-tss is a software stack supporting Trusted Platform Module(TPM) 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote.(CVE-2024-29040)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:17:22.70861996Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1638","title":"tpm2-tss security update","description":"tpm2-tss is a software stack supporting Trusted Platform Module(TPM) 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote.(CVE-2024-29040)","status":"published","published":"2024-05-24T11:07:06Z","modified":"2026-08-18T01:17:23.015176982Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-29040","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-04-22T14:48:23.494071Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-42978","title":"CVE-2024-29040 affecting package tpm2-tss for versions less than 4.0.2-1","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:15:02Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-42985","title":"CVE-2024-29040 affecting package tpm2-tss for versions less than 2.4.6-4","description":"This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.","status":"published","published":"2024-06-28T21:15:02Z","modified":"2026-04-21T04:30:50.661896Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"MGASA-2024-0171","title":"Updated tpm2-tss packages fix security vulnerabilities","description":"A flaw was found in the tpm2-tss package, where there was no check that\nthe magic number in the attest is equal to the\nTPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary\nquote data, which may not be detected by Fapi_VerifyQuote.\n","status":"published","published":"2024-05-09T02:40:29Z","modified":"2026-04-16T04:40:40.613765681Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13933-1","title":"libtss2-esys0-32bit-4.1.0-1.1 on GA media","description":"These are all security issues fixed in the libtss2-esys0-32bit-4.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:04.750582Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1605-1","title":"Security update for tpm2-0-tss","description":"This update for tpm2-0-tss fixes the following issues:\n\n- CVE-2024-29040: Fixed quote data validation by Fapi_VerifyQuote (bsc#1223690).\n","status":"published","published":"2024-05-10T14:13:17Z","modified":"2026-02-04T03:52:52.488584Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1635-1","title":"Security update for tpm2-0-tss","description":"This update for tpm2-0-tss fixes the following issues:\n\n- CVE-2024-29040: Fixed quote data validation by Fapi_VerifyQuote (bsc#1223690).\n","status":"published","published":"2024-05-14T09:36:52Z","modified":"2026-02-04T03:26:09.831279Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1635-2","title":"Security update for tpm2-0-tss","description":"This update for tpm2-0-tss fixes the following issues:\n\n- CVE-2024-29040: Fixed quote data validation by Fapi_VerifyQuote (bsc#1223690).\n","status":"published","published":"2024-05-14T09:37:06Z","modified":"2026-02-04T04:14:54.330716Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2025:20151-1","title":"Security update for tpm2.0-tools, tpm2-0-tss","description":"This update for tpm2.0-tools, tpm2-0-tss fixes the following issues:\n\ntpm2-0-tss:\n  Update to version 4.1:\n  + Security\n    - CVE-2024-29040: arbitrary quote data may go undetected by Fapi_VerifyQuote (bsc#1223690)\n\n  + Fixed\n    - fapi: Fix length check on FAPI auth callbacks\n    - mu: Correct error message for errors\n    - tss2-rc: fix unknown laer handler dropping bits.\n    - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).\n    - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.\n    - build: fix build fail after make clean.\n    - mu: Fix unneeded size check in TPM2B unmarshaling.\n    - fapi: Fix missing parameter encryption.\n    - build: Fix failed build with --disable-vendor.\n    - fapi: Fix flush of persistent handles.\n    - fapi: Fix test provisioning with template with self generated certificate disabled.\n    - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.\n    - fapi: Revert pcr extension for EV_NO_ACTION events.\n    - fapi: Fix strange error messages if nv, ext, or policy path does not exits.\n    - fapi: Fix segfault caused by wrong allocation of pcr policy.\n    - esys: Fix leak in Esys_EvictControl for persistent handles.\n    - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.\n    - esys: Add reference counting for Esys_TR_FromTPMPublic.\n    - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.\n    - fapi: fix usage of self signed certificates in TPM.\n    - fapi: Usage of self signed certificates.\n    - fapi: A segfault after the error handling of non existing keys.\n    - fapi: Fix several leaks.\n    - fapi: Fix error handling for policy execution.\n    - fapi: Fix usage of persistent handles (should not be flushed)\n    - fapi: Fix test provisioning with template (skip test without self generated certificate).\n    - fapi: Fix pcr extension for EV_NO_ACTION\n    - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile\n    - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set\n    - fapi: Fix read large system eventlog (\u003e UINT16_MAX).\n    - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)\n    - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.\n    - fapi: Fix possible null pointer dereferencing in Fapi_List.\n    - sys: Fix size check in Tss2_Sys_GetCapability.\n    - esys: Fix leak in Esys_TR_FromTPMPublic.\n    - esys: fix unchecked return value in esys crypto.\n    - fapi: Fix wrong usage of local variable in provisioning.\n    - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.\n    - fapi: Fix possible out of bound array access in IMA parser.\n    - tcti device: Fix possible unmarshalling from uninitialized variable.\n    - fapi: Fix error checking authorization of signing key.\n    - fapi: Fix cleanup of policy sessions.\n    - fapi: Eventlog H-CRTM events and different localities.\n    - fapi: Fix missing synchronization of quote and eventlog.\n    - faii: Fix invalid free in Fapi_Quote with empty eventlog.\n\n  + Added\n    - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.\n    - mbedtls: add sha512 hmac.\n    - fapi: Enable usage of external keys for Fapi_Encrypt.\n    - fapi: Support download of AMD certificates.\n    - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.\n    - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.\n    - rc: New TPM return codes added.\n    - fapi: Further Nuvoton certificates added.\n    - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.\n    - tcti: Add '/dev/tcm0' to default conf\n    - fapi: New Nuvoton certificates added.\n    - esys: Fix leak in Esys_TR_FromTPMPublic.\n\n  + Removed\n    - Testing on Ubuntu 18.04 as it's near EOL (May 2023).\n\n\ntpm2.0-tools:\n  Update to version 5.7:\n  + Security\n    - CVE-2024-29038: arbitrary quote data may go undetected by tpm2_checkquote (bsc#1223687)\n    - CVE-2024-29039: pcr selection value is not compared with the attest (bsc#1223689)\n  + Fixed\n    - Fix eventlog test\n    - Fix issues with reading NV indexes\n    - Fix context save error on tpm2_create\n    - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail\n    - when attempting to context save a flushed session.\n    - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.\n    - tpm2_send: fix EOF detection on input stream.\n    - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.\n    - tpm2_nvread: fix input handling no nv index.\n    - Auth file: Ensure 0-termination when reading auths from a file.\n    - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.\n    - cirrus.yml fix tss compilation with libtpms for FreeBSD.\n    - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.\n    - options: fix TCTI handling to avoid failures for commands that should work with no options.\n    - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.\n  + Added\n    - Add the possibility for autoflush (environment variable \"TPM2TOOLS_AUTOFLUSH\", or -R option)\n  + Removed\n    - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.\n    - tpm2_nvread: fix input handling no nv index.\n\n  - Update to version 5.6\n    + tpm2_eventlog:\n      * add H-CRTM event support\n      * add support of efivar versions less than 38\n      * Add support to check for efivar/efivar.h manually\n      * Minor formatting fixes\n      * tpm2_eventlog: add support for replay with different StartupLocality\n      * Fix pcr extension for EV_NO_ACTION\n      * Extend test of yaml string representation\n      * Use helper for printing a string dump\n      * Fix upper bound on unique data size\n      * Fix YAML string formatting\n    + tpm2_policy:\n      * Add support for parsing forward seal TPM values\n      * Use forward seal values in creating policies\n      * Move dgst_size in evaluate_populate_pcr_digests()\n      * Allow more than 8 PCRs for sealing\n      * Move dgst_size in evaluate_populate_pcr_digests\n      * Allow more than 8 PCRs for sealing\n      * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more PCRs\n    + tpm2_encryptdecrypt: Fix pkcs7 padding stripping\n    + tpm2_duplicate:\n      * Support -a option for attributes\n      * Add --key-algorithm option\n    + tpm2_encodeobject: Use the correct -O option instead of -C\n    + tpm2_unseal: Add qualifier static to enhance the privacy of unseal\n      function\n    + tpm2_sign:\n      * Remove -m option which was added mistakenly\n      * Revert sm2 sign and verifysignature\n    + tpm2_createek:\n      * Correct man page example\n      * Fix usage of nonce\n      * Fix integrating nonce\n    + tpm2_clear: add more details about the action\n    + tpm2_startauthsession: allow the file attribute for policy\n      authorization.\n    + tpm2_getekcertificate: Add AMD EK support\n    + tpm2_ecdhzgen: Add public-key parameter\n    + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure\n    + Bug-fixes:\n      * The readthedocs build failed with module 'jinja2' has no\n        attribute 'contextfilter' a requirement file was added to fix\n        this problem\n      * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa\n        implementation. This error can be avoided by switching off the\n        optimization with pragma\n      * Changed wrong function name of \"Esys_Load\" to \"Esys_Load\"\n      * Function names beginning with Esys_ are wrongly written as Eys_\n      * Reading and writing a serialized persistent ESYS_TR handles\n      * cirrus-ci update image-family to freebsd-13-2 from 13-1\n    + misc:\n      * Change the default Python version to Python3 in the helper's code\n      * Skip test which uses the sign operator for comparison in\n        abrmd_policynv.sh\n      * tools/tr_encode: Add a tool that can encode serialized ESYS_TR\n        for persistent handles from the TPM2B_PUBLIC and the raw\n        persistent TPM2_HANDLE\n      * Add safe directory in config\n","status":"published","published":"2025-03-18T10:58:34Z","modified":"2026-03-23T04:48:52.943979Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6796-1","title":"tpm2-tss vulnerabilities","description":"Fergus Dall discovered that TPM2 Software Stack did not properly handle\nlayer arrays. An attacker could possibly use this issue to cause \nTPM2 Software Stack to crash, resulting in a denial of service, or \npossibly execute arbitrary code.\n(CVE-2023-22745)\n\nJurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not \nvalidate the quote data after deserialization. An attacker could generate\nan arbitrary quote and cause TPM2 Software Stack to have unknown behavior. \n(CVE-2024-29040)\n","status":"published","published":"2024-05-29T13:21:53Z","modified":"2026-04-27T17:15:01.818342Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}