CVE-2024-29039 Affecting tpm2-tools package, versions <0:5.2-4.el9
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-TPM2TOOLS-8383773
- published 18 Nov 2024
- disclosed 12 Nov 2024
How to fix?
Upgrade AlmaLinux:9 tpm2-tools to version 0:5.2-4.el9 or higher.
This issue was patched in ALSA-2024:9424.
NVD Description
Note: Versions mentioned in the description apply only to the upstream tpm2-tools package and not the tpm2-tools package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:9 relevant fixed versions and status.
tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.