Reliance on Untrusted Inputs in a Security Decision in tpm2-tools - CVE-2024-29039

Vulnerability identifier: #VU96645

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-29039

CWE-ID: CWE-807

Exploitation vector: Local access

Exploit availability: No public exploit available

Affected software:
tpm2-tools
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Fedora
tpm2-tss
tpm2-tools-help
tpm2-tools-debugsource
tpm2-tools-debuginfo
tpm2-tools
tpm2-tools (Red Hat package)
tpm2.0-tools
tpm2.0-tools-debuginfo
tpm2.0-tools-debugsource

The vulnerability allows a local user to manipulate the TMP state.

The vulnerability exists due to insufficient validation of PCR input. A local user can alter TPML_PCR_SELECTION and manipulate the TMP state.

Install updates from vendor's website.

• https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6
• https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7