tpm2-tools (tpm2_checkquote TPM2_GENERATED magic validation): tpm2_checkquote does not verify that the structure

UnscoredCVE-2024-29038Firmware, BMC & network fabriccurated

Impact

tpm2_checkquote does not verify that the structure it is checking was actually generated by a TPM, so a fabricated quote passes validation. The sibling of the tpm2-tss issue in the same disclosure, and it hits the command-line tool that most operators' attestation scripts actually shell out to. Result is the same: a machine with no TPM, or a machine whose TPM state is wrong, can present as attested.

Who can reach it

A malicious or compromised endpoint producing its own quote artefacts. The attacker is the thing claiming to be healthy.

What to do

Package update to a fixed tpm2-tools wherever verification runs, then restart the verifying service and re-run attestation across the fleet - old results are not evidence. Package-level fix, no reboot. Check whether your attestation pipeline calls tpm2_checkquote, the tpm2-tss FAPI, or its own verifier, because all three had this same missing check and they patch through different channels.

References

https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f https://nvd.nist.gov/vuln/detail/CVE-2024-29038

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.