Lucene search

K
mageiaGentoo FoundationMGASA-2024-0170
HistoryMay 09, 2024 - 5:40 a.m.

Updated tpm2-tools packages fixes security vulnerabilities

2024-05-0905:40:29
Gentoo Foundation
advisories.mageia.org
12
tpm2-tools
security vulnerabilities
attestation
comparison vulnerability
pcr selection

7.3 High

AI Score

Confidence

Low

A flaw was found in the tpm2-tools package. This issue occurs due to a missing check whether the magic number in attest is equal to TPM2_GENERATED_VALUE, which can allow an attacker to generate arbitrary quote data that may not be detected by tpm2_checkquote (CVE-2024-29038). The pcr selection which is passed with the --pcr parameter is not compared with the attest. So it is possible to fake a valid attestation (CVE-2024-29039). A vulnerability classified as problematic was found in tpm2-tools. This vulnerability affects an unknown code of the file tools/misc/tpm2_checkquote.c of the component pcr Selection Value Handler. The manipulation with an unknown input leads to a comparison vulnerability. The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

OSVersionArchitecturePackageVersionFilename
Mageia9noarchtpm2-tools< 5.5.1-1tpm2-tools-5.5.1-1.mga9

7.3 High

AI Score

Confidence

Low