Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 931056 (CVE-2024-29038, CVE-2024-29039) - <app-crypt/tpm2-tools-5.6.1: Missing comparison of PCR selection and uncheck magic number in verify quote
Summary: <app-crypt/tpm2-tools-5.6.1: Missing comparison of PCR selection and uncheck ...
Status: IN_PROGRESS
Alias: CVE-2024-29038, CVE-2024-29039
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [stable]
Keywords: PullRequest
Depends on: 931272
Blocks:
  Show dependency tree
 
Reported: 2024-05-01 16:08 UTC by Christopher Byrne
Modified: 2024-05-06 06:13 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Byrne 2024-05-01 16:08:38 UTC 
tpm2_checkquote: Add comparison of pcr selection.

The pcr selection which is passed with the --pcr parameter it not
compared with the attest. So it's possible to fake a valid
attestation.

Fixes: CVE-2024-29039

tpm2_checkquote: Fix check of magic number.

It was not checked whether the magic number in the
attest is equal to TPM2_GENERATED_VALUE.
So an malicious attacker could generate arbitrary quote data
which was not detected by tpm2 checkquote.

Fixes: CVE-2024-29038
Comment 1 Larry the Git Cow gentoo-dev 2024-05-05 11:36:47 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ebff9657edadc8779ed9fde8e2b2debd7bfcac53

commit ebff9657edadc8779ed9fde8e2b2debd7bfcac53
Author:     Christopher Byrne <salah.coronya@gmail.com>
AuthorDate: 2024-04-26 16:52:01 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2024-05-05 11:36:21 +0000

    app-crypt/tpm2-tools: add 5.6.1
    
    Bug: https://bugs.gentoo.org/931056
    
    Signed-off-by: Christopher Byrne <salah.coronya@gmail.com>
    Signed-off-by: Sam James <sam@gentoo.org>

 app-crypt/tpm2-tools/Manifest                |  1 +
 app-crypt/tpm2-tools/tpm2-tools-5.6.1.ebuild | 87 ++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+)