CVE-2024-29038
tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- EPSS probability
- 0.37%
- CWE
- CWE-1283, CWE-1390
- Published
- 2024-06-28
- Last modified
- 2026-03-13
Affected products
- tpm2-software tpm2-tools
Weakness type
Related vulnerabilities
- CVE-2023-3674 — Keylime: attestation failure when the quote's signature does not validate
- CVE-2022-1740 — 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283