CVE-2024-29038 tpm2 does not detect if quote was not generated by TPM
Attackers can forge TPM quote data that bypasses verification in tpm2-tools, undermining integrity checks for trusted platform modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29038?
CVE-2024-29038 is a medium-severity vulnerability in tpm2-software tpm2-tools, published on 28 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.
Which versions are affected by CVE-2024-29038?
It affects 1 product.
Products include Tpm2-Tools Project Tpm2-Tools.
How do I fix CVE-2024-29038?
Upgrade to a fixed version.
Is CVE-2024-29038 being exploited?
There is no known exploitation of CVE-2024-29038 in the wild and no public exploit code.
Other vulnerabilities in tpm2-software tpm2-tools
Sources
Also known as AZL-43018, CLSA-2026-1782977868, DEBIAN-CVE-2024-29038, GHSA-5495-c38w-gr6f, UBUNTU-CVE-2024-29038.