CVE-2024-29039
CVE-2024-29039 allows attackers to manipulate tpm2_checkquote outputs, leading to a misleading picture of the TPM state. This impacts the trustworthiness of security attestations. The vulnerability in the Trusted Platform Module (TPM2.0) tools source repository stems from improper handling of TPML_PCR_SELECTION within the PCR input file, causing incorrect mapping of digest values. An attacker can exploit this to misrepresent the system's security posture. While the CVSS score is 0, indicating a base severity of none, the SOCRadar Vulnerability Risk Score (SVRS) of 34 suggests a low to moderate risk. Though not critical, this vulnerability could be used to bypass security measures if chained with other exploits. Update to version 5.7 to patch this security vulnerability and maintain the integrity of your TPM.
Description
CVE-2024-29039 is a vulnerability in tpm2, the source repository for Trusted Platform Module (TPM2.0) tools. It allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. This results in incorrect mapping of digest values to PCR slots and banks, providing a misleading representation of the TPM state.
Key Insights
- High Severity: The CVSS score of 9 indicates a high severity vulnerability, requiring immediate attention.
- SVRS Score: The SOCRadar Vulnerability Risk Score (SVRS) of 34 suggests a moderate risk, highlighting the need for monitoring and mitigation.
- Exploit Status: Active exploits have been published, indicating that attackers are actively exploiting this vulnerability.
- CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
Mitigation Strategies
- Update to tpm2 version 5.7 or later.
- Implement strong authentication mechanisms to prevent unauthorized access to TPM devices.
- Monitor for suspicious activity and investigate any anomalies promptly.
- Regularly review and update security policies and procedures to address emerging threats.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.