{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29040", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-14T16:59:47.614Z", "datePublished": "2024-06-28T21:02:04.076Z", "dateUpdated": "2024-08-02T01:03:51.704Z"}, "containers": {"cna": {"title": "Fapi Verify Quote: Does not detect if quote was not generated by TPM", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}], "affected": [{"vendor": "tpm2-software", "product": "tpm2-tss", "versions": [{"version": "< 4.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T21:02:04.076Z"}, "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}], "source": {"advisory": "GHSA-837m-jw3m-h9p6", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "tpm2_software_stack_project", "product": "tpm2_software_stack", "cpes": ["cpe:2.3:a:tpm2_software:tpm2_tools:*:*:*:*:*:*:*:*", "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.1.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T18:42:06.230859Z", "id": "CVE-2024-29040", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T18:49:43.456Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:03:51.704Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}, {"name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29040", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-02T18:42:06.230859Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tpm2_software:tpm2_tools:*:*:*:*:*:*:*:*", "cpe:2.3:a:tpm2_software_stack_project:tpm2_software_stack:*:*:*:*:*:*:*:*"], "vendor": "tpm2_software_stack_project", "product": "tpm2_software_stack", "versions": [{"status": "affected", "version": "0", "lessThan": "4.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T18:49:09.397Z"}}], "cna": {"title": "Fapi Verify Quote: Does not detect if quote was not generated by TPM", "source": {"advisory": "GHSA-837m-jw3m-h9p6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "tpm2-software", "product": "tpm2-tss", "versions": [{"status": "affected", "version": "< 4.1.0"}]}], "references": [{"url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "name": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "name": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-28T21:02:04.076Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29040", "state": "PUBLISHED", "dateUpdated": "2024-07-02T18:49:43.456Z", "dateReserved": "2024-03-14T16:59:47.614Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-28T21:02:04.076Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0."}, {"lang": "es", "value": "Este repositorio aloja el c\u00f3digo fuente que implementa la pila de software (TSS) TPM2 de Trusted Computing Group (TCG). Fapi_VerifyQuote debe deserializar la informaci\u00f3n de cotizaci\u00f3n JSON devuelta por Fapi_Quote a la estructura TPM `TPMS_ATTEST`. Para el campo `TPM2_GENERATED magic` de esta estructura se puede utilizar cualquier n\u00famero en la estructura JSON. El verificador puede recibir un estado que no representa el estado real, posiblemente malicioso, del dispositivo bajo prueba. El dispositivo malicioso puede obtener acceso a datos que no deber\u00eda o puede utilizar servicios que no deber\u00eda poder. Este problema se solucion\u00f3 en la versi\u00f3n 4.1.0."}], "id": "CVE-2024-29040", "lastModified": "2024-07-01T12:37:24.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-06-28T21:15:02.773", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote", "id": "2278077", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2278077"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-20", "details": ["This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.", "A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote."], "name": "CVE-2024-29040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "tpm2-tss", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-29040\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-29040"], "statement": "This vulnerability is rated as moderate because it allows an attacker to generate arbitrary quote data, potentially bypassing Fapi_VerifyQuote detection, but it requires specific conditions to be exploited.", "threat_severity": "Moderate", "upstream_fix": "tpm2-tss 4.1.0"}