CVE-2024-29040— Fapi Verify Quote: Does not detect if quote was not generated by TPM
Quick assessment
Affected
tpm2-software tpm2-tss
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
tpm2-tss是tpm2开源的一个 TCG TPM2 软件堆栈（TSS2）的 OSS 实现。 tpm2-tss 4.0.1及之前版本存在安全漏洞，该漏洞源于JSON结构可以使用任意数字，导致攻击者可因此获得不应有的数据访问权限或服务权限。
Possible ATT&CK Techniques 1 AI
T1552.003 · Shell History
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-29040
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fapi Verify Quote: Does not detect if quote was not generated by TPM
Source: CVE Program / CVE List V5
Vulnerability Description
This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This
issue has been patched in version 4.1.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
tpm2-tss 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
tpm2-tss是tpm2开源的一个 TCG TPM2 软件堆栈（TSS2）的 OSS 实现。 tpm2-tss 4.0.1及之前版本存在安全漏洞，该漏洞源于JSON结构可以使用任意数字，导致攻击者可因此获得不应有的数据访问权限或服务权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tpm2-software | tpm2-tss | < 4.1.0 | - |
|
II. Public POCs for CVE-2024-29040
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-29040
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-29040 (1)
Other References for CVE-2024-29040 (1)
-
https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0 x_refsource_MISC
Same Patch Batch · tpm2-software · 2024-06-28 · 3 CVEs total
| CVE-2024-29039 | 9.1 CRITICAL | Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state |
| CVE-2024-29038 | 4.3 MEDIUM | tpm2 does not detect if quote was not generated by TPM |
IV. Related Vulnerabilities
Same weakness: CWE-502
-
CVE-2026-94064
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - P -
CVE-2026-94065
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vul -
CVE-2026-100730
Grid Protection Alliance openPDC and openHistorian Deseriali -
CVE-2026-104392
WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Obje -
CVE-2026-105872
WordPress Product Configurator for WooCommerce plugin <= 1.7
V. Comments for CVE-2024-29040
No comments yet