CVE-2024-29039
📋 TL;DR
This vulnerability in tpm2-tools allows attackers to manipulate TPM quote verification results by tampering with PCR input files. Attackers can make the system incorrectly map digest values to PCR slots and banks, creating a misleading picture of the TPM state. This affects systems using tpm2-tools for TPM attestation and integrity verification.
💻 Affected Systems
- tpm2-tools
📦 What is this software?
Tpm2 Tools by Tpm2 Tools Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass TPM-based integrity checks, allowing compromised systems to appear trustworthy while running malicious code, potentially enabling supply chain attacks or credential theft.
Likely Case
Attackers could manipulate attestation results to hide system compromises, bypass security controls that rely on TPM measurements, or create false integrity reports.
If Mitigated
With proper input validation and integrity checks, the impact is limited to systems that accept untrusted PCR input files without verification.
🎯 Exploit Status
Exploitation requires access to modify PCR input files and knowledge of how to manipulate TPML_PCR_SELECTION structures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7
Vendor Advisory: https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6
Restart Required: No
Instructions:
1. Update tpm2-tools to version 5.7 or later using your package manager. 2. For source installations: download from https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7 and compile. 3. Verify the update with 'tpm2_checkquote --version'.
🔧 Temporary Workarounds
Validate PCR input files
allOnly use trusted, cryptographically verified PCR input files with tpm2_checkquote
Restrict file permissions
linuxSet strict permissions on PCR input files to prevent unauthorized modification
chmod 600 /path/to/pcr_input_file
🧯 If You Can't Patch
- Implement additional integrity checks on PCR input files before processing
- Use alternative TPM attestation methods that don't rely on tpm2_checkquote with external PCR files
🔍 How to Verify
Check if Vulnerable:
Check tpm2-tools version with 'tpm2_checkquote --version' or 'tpm2 --version'. If version is below 5.7, the system is vulnerable.Check Version:
tpm2_checkquote --version || tpm2 --versionVerify Fix Applied:
After updating, verify version is 5.7 or higher with 'tpm2_checkquote --version'. Test with known good PCR input files to ensure proper validation.📡 Detection & Monitoring
Log Indicators:
- Unexpected tpm2_checkquote failures
- Mismatches in PCR validation results
- Suspicious modifications to PCR input files
Network Indicators:
- Unusual network activity following TPM attestation processes
SIEM Query:
Process execution logs showing tpm2_checkquote with modified PCR input files or unexpected arguments🔗 References
- https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
- https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6
- https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7
- https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/
