CVE-2024-29038: tpm2 does not detect if quote was not generated by TPM

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-28 · updated 2026-06-17
Weakness: CWE-1283

Description

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

Affected products

tpm2-software tpm2-tools: from 4.1 before 5.5.1; from 5.6.1 (excl.) before 5.7 — fixed in 5.5.1, 5.7

How to fix

Upgrade to a fixed version: tpm2-software tpm2-tools 5.5.1, 5.7. Check the vendor advisory for mitigations.

References

https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f
https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/

Get alerted when CVE-2024-29038 or the next vulnerability affects your stack