tpm2-tools (tpm2_checkquote PCR selection handling): tpm2_checkquote does not validate the TPML_PCR_SELECTION

Impact

tpm2_checkquote does not validate the TPML_PCR_SELECTION in the supplied PCR input file, so an attacker who controls that file makes digests map to the wrong PCR slots and banks. The verifier then reports a perfectly valid signature over a misread picture of the machine's state - a node running a tampered boot chain can be made to look like it booted the golden image. Rated critical by the maintainers. For anyone whose product promise is 'verified clean bare metal' or whose scheduler gates on attestation, this is the tool that silently makes the check meaningless.

Who can reach it

The attacker is the attested machine, or anything that can influence the PCR input file the verifier reads. If your verifier consumes quote artefacts uploaded by the node being checked - which is the common design - the node controls its own grade.

What to do

Package update to a fixed tpm2-tools on every host that verifies quotes, plus a restart of the verifying service. No firmware, no reboot, so it is cheap - but the second half is not: every attestation result produced by the old tool proves nothing, so re-attest the fleet after updating. Structurally, the verifier should pin the expected PCR selection itself rather than accepting one supplied alongside the quote.

References