OESA-2024-2083

tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by tpm2 checkquote. This issue was patched in version 5.7.(CVE-2024-29038)

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2checkquote outputs by altering the TPMLPCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.(CVE-2024-29039)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:22.03-LTS-SP1 / tpm2-tools

Package

Name: tpm2-tools
Purl: pkg:rpm/openEuler/tpm2-tools&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.0-6.oe2203sp1

Ecosystem specific

{
    "src": [
        "tpm2-tools-5.0-6.oe2203sp1.src.rpm"
    ],
    "noarch": [
        "tpm2-tools-help-5.0-6.oe2203sp1.noarch.rpm"
    ],
    "x86_64": [
        "tpm2-tools-5.0-6.oe2203sp1.x86_64.rpm",
        "tpm2-tools-debuginfo-5.0-6.oe2203sp1.x86_64.rpm",
        "tpm2-tools-debugsource-5.0-6.oe2203sp1.x86_64.rpm"
    ],
    "aarch64": [
        "tpm2-tools-5.0-6.oe2203sp1.aarch64.rpm",
        "tpm2-tools-debuginfo-5.0-6.oe2203sp1.aarch64.rpm",
        "tpm2-tools-debugsource-5.0-6.oe2203sp1.aarch64.rpm"
    ]
}