Reliance on Untrusted Inputs in a Security Decision in tpm2-tools - CVE-2024-29039

Vulnerability identifier: #VU96645

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29039

CWE-ID: CWE-807

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to manipulate the TMP state.

The vulnerability exists due to insufficient validation of PCR input. A local user can alter TPML_PCR_SELECTION and manipulate the TMP state.

tpm2-tools
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Fedora
tpm2-tss
tpm2-tools-help
tpm2-tools-debugsource
tpm2-tools-debuginfo
tpm2-tools
tpm2-tools (Red Hat package)
tpm2.0-tools
tpm2.0-tools-debuginfo
tpm2.0-tools-debugsource

Install updates from vendor's website.

tpm2-tools - addressed in versions 5.5.1, 5.6.1, 5.7
tpm2-tss - addressed in versions 4.0.2-1.fc38, 4.0.2-1.fc39, 4.1.0-1.fc40
tpm2-tools-help - addressed in versions 5.0-5, 5.0-6
tpm2-tools-debugsource - addressed in versions 5.0-5, 5.0-6
tpm2-tools-debuginfo - addressed in versions 5.0-5, 5.0-6
tpm2-tools - addressed in versions 5.0-5, 5.0-6
tpm2-tools (Red Hat package) - update to 5.2-4.el9
tpm2.0-tools - update to 5.2-150400.6.3.1
tpm2.0-tools-debuginfo - update to 5.2-150400.6.3.1
tpm2.0-tools-debugsource - update to 5.2-150400.6.3.1
tpm2-tools - addressed in versions 5.5.1-1.fc38, 5.5.1-1.fc39, 5.7-1.fc40
tpm2-tools - update to 5.7-2

• https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6
• https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7

• Multiple vulnerabilities in Trusted Platform Module (TPM2.0) tools
• SUSE update for tpm2.0-tools
• Fedora 38 update for tpm2-tools, tpm2-tss
• Fedora 39 update for tpm2-tools, tpm2-tss
• Fedora 40 update for tpm2-tools, tpm2-tss
• openEuler 22.03 LTS SP3 update for tpm2-tools
• openEuler 20.03 LTS SP4 update for tpm2-tools
• openEuler 22.03 LTS SP1 update for tpm2-tools
• Red Hat Enterprise Linux 9 update for tpm2-tools
• Anolis OS update for tpm2-tools