CVE-2024-29040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-29040", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-14T16:59:47.614Z", "datePublished": "2024-06-28T21:02:04.076Z", "dateUpdated": "2025-11-04T17:19:50.283Z"}, "containers": {"cna": {"title": "Fapi Verify Quote: Does not detect if quote was not generated by TPM", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}], "affected": [{"vendor": "tpm2-software", "product": "tpm2-tss", "versions": [{"version": "< 4.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T21:02:04.076Z"}, "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}], "source": {"advisory": "GHSA-837m-jw3m-h9p6", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "tpm2_software_stack_project", "product": "tpm2_software_stack", "cpes": ["cpe:2.3:a:tpm2_software:tpm2_tools:*:*:*:*:*:*:*:*", "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.1.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T18:42:06.230859Z", "id": "CVE-2024-29040", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T18:49:43.456Z"}}, {"title": "CVE Program Container", "references": [{"name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:19:50.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T17:19:50.283Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29040", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T18:42:06.230859Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tpm2_software:tpm2_tools:*:*:*:*:*:*:*:*", "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*"], "vendor": "tpm2_software_stack_project", "product": "tpm2_software_stack", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T18:49:09.397Z"}}], "cna": {"title": "Fapi Verify Quote: Does not detect if quote was not generated by TPM", "source": {"advisory": "GHSA-837m-jw3m-h9p6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tpm2-software", "product": "tpm2-tss", "versions": [{"status": "affected", "version": "< 4.1.0"}]}], "references": [{"url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T21:02:04.076Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29040", "state": "PUBLISHED", "dateUpdated": "2025-11-04T17:19:50.283Z", "dateReserved": "2024-03-14T16:59:47.614Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-28T21:02:04.076Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "tpm2-tss", "vendor": "tpm2-software", "versions": [{"status": "affected", "version": "< 4.1.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:tpm2_software:tpm2_tools:*:*:*:*:*:*:*:*", "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "tpm2_software_stack", "vendor": "tpm2_software_stack_project", "versions": [{"lessThan": "4.1.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}, {"lang": "es", "value": "Este repositorio aloja el c\u00f3digo fuente que implementa la pila de software (TSS) TPM2 de Trusted Computing Group (TCG). Fapi_VerifyQuote debe deserializar la informaci\u00f3n de cotizaci\u00f3n JSON devuelta por Fapi_Quote a la estructura TPM `TPMS_ATTEST`. Para el campo `TPM2_GENERATED magic` de esta estructura se puede utilizar cualquier n\u00famero en la estructura JSON. El verificador puede recibir un estado que no representa el estado real, posiblemente malicioso, del dispositivo bajo prueba. El dispositivo malicioso puede obtener acceso a datos que no deber\u00eda o puede utilizar servicios que no deber\u00eda poder. Este problema se solucion\u00f3 en la versi\u00f3n 4.1.0."}], "id": "CVE-2024-29040", "lastModified": "2026-06-17T07:22:18.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-29040", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-07-02T18:42:06.230859Z", "version": "2.0.3"}}]}, "published": "2024-06-28T21:15:02.773", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote", "id": "2278077", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278077"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-20", "details": ["This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.", "A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote."], "name": "CVE-2024-29040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-29040\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29040"], "statement": "This vulnerability is rated as moderate because it allows an attacker to generate arbitrary quote data, potentially bypassing Fapi_VerifyQuote detection, but it requires specific conditions to be exploited.\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.", "threat_severity": "Moderate"}

{}