tpm2-tools (tpm2_checkquote TPM2_GENERATED magic validation): tpm2_checkquote does not verify that the structure

Impact

tpm2_checkquote does not verify that the structure it is checking was actually generated by a TPM, so a fabricated quote passes validation. The sibling of the tpm2-tss issue in the same disclosure, and it hits the command-line tool that most operators' attestation scripts actually shell out to. Result is the same: a machine with no TPM, or a machine whose TPM state is wrong, can present as attested.

Who can reach it

A malicious or compromised endpoint producing its own quote artefacts. The attacker is the thing claiming to be healthy.

What to do

Package update to a fixed tpm2-tools wherever verification runs, then restart the verifying service and re-run attestation across the fleet - old results are not evidence. Package-level fix, no reboot. Check whether your attestation pipeline calls tpm2_checkquote, the tpm2-tss FAPI, or its own verifier, because all three had this same missing check and they patch through different channels.

References