Security Vulnerability in tpm2-tools: Arbitrary Quote Data and PCR Selection Issues
Summary
ALSA-2024:9424: Low: tpm2-tools security update. Affects tpm2-tools versions < 5.2-4.el9. Fixed in 5.2-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tpm2-tools package provides a suite of utilities designed for the management and utilization of Trusted Platform Module (TPM) 2.0 devices from user space. These tools are essential for ensuring secure operations in computing environments that rely on hardware-based security features. However, vulnerabilities in these tools can lead to significant security risks, particularly in how they handle quote data and PCR (Platform Configuration Register) selections.
Vulnerability Detail
The tpm2-tools package has been identified with two critical vulnerabilities. The first, CVE-2024-29038, allows arbitrary quote data to go undetected by the tpm2_checkquote utility, potentially enabling unauthorized access or manipulation of sensitive data. The second vulnerability, CVE-2024-29039, involves a failure to compare the PCR selection value with the attest, which could lead to incorrect security assessments and compromise the integrity of the TPM functionalities. These vulnerabilities could be exploited by attackers to bypass security measures, leading to unauthorized access to secure environments.
How To Fix
Minimum fixed version
5.2-4.el9
This is the first release that contains the fix.
sudo dnf update tpm2-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for these vulnerabilities. The best course of action is to apply the available security updates as soon as possible.
Conclusion
The tpm2-tools package has critical vulnerabilities that could compromise the security of systems utilizing TPM 2.0 devices. It is essential to update to the latest patched version to safeguard against potential exploits. Regular monitoring and updates are vital for maintaining security in open-source software.
See every vulnerability recorded for tpm2-tools →
FAQ
The main vulnerabilities include the potential for arbitrary quote data to go undetected and the failure to compare PCR selection values with attestation data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Exploitation of these vulnerabilities could lead to unauthorized access to sensitive data and compromise the integrity of security measures provided by TPM.
Yes, a patch is available in the form of an updated package version 5.2-4.el9 for tpm2-tools.
While no specific workarounds are available, it is crucial to prioritize updating the package to mitigate the risks associated with these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for tpm2-tools.
