CVE-2024-29040 Fapi Verify Quote: Does not detect if quote was not generated by TPM
Attackers can bypass TPM quote verification by manipulating JSON fields, potentially gaining unauthorized access to data or services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29040?
CVE-2024-29040 is a medium-severity unsafe deserialization vulnerability in tpm2-software tpm2-tss, published on 28 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0.
Weakness: CWE-502
Which versions are affected by CVE-2024-29040?
Linux distribution packages (8)
tpm2-0-tss SUSE:Linux Enterprise Micro 5.3 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss SUSE:Linux Enterprise Micro 5.4 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss SUSE:Linux Enterprise Micro 5.5 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss SUSE:Linux Enterprise Micro 5.5 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss openSUSE:Leap 15.5 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss openSUSE:Leap Micro 5.3 | All versions | 3.1.0-150400.3.6.1 |
tpm2-0-tss openSUSE:Leap Micro 5.4 | All versions | 3.1.0-150400.3.6.1 |
How do I fix CVE-2024-29040?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-29040 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29040 exists.
Sources
Also known as AZL-42978, AZL-42985, BELL-CVE-2024-29040, DEBIAN-CVE-2024-29040, GHSA-837m-jw3m-h9p6, MGASA-2024-0171 and 8 more.