CVE-2024-29040

2024-04-3000:00:00

ubuntu.com

security

vulnerability

cve-2024-29040

unix

6.6 Medium

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

After deserializing the quote info it was not checked whether
the magic number in the attest is equal TPM2_GENERATED_VALUE.
So an malicious attacker could generate arbitrary quote data
which was not detected by Fapi_VerifyQuote.

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchtpm2-tss< 3.2.0-1ubuntu1.1UNKNOWN
ubuntu23.10noarchtpm2-tss< 4.0.1-3ubuntu1.1UNKNOWN
ubuntu24.04noarchtpm2-tss< 4.0.1-7.1ubuntu5.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	tpm2-tss	< 3.2.0-1ubuntu1.1	UNKNOWN
ubuntu	23.10	noarch	tpm2-tss	< 4.0.1-3ubuntu1.1	UNKNOWN
ubuntu	24.04	noarch	tpm2-tss	< 4.0.1-7.1ubuntu5.1	UNKNOWN