CVE-2024-29039 - CVE House
Back to Database
Status published Critical CVE-2024-29039

Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

Vulnerability Description

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-29039

Credits & Attribution

No credits recorded in the NVD database.

References

More from tpm2-software

View All →
CVE-2024-29040
Fapi Verify Quote: Does not detect if quote was not generated by TPM
Medium 4.3
CVE-2024-29038
tpm2 does not detect if quote was not generated by TPM
Medium 4.3
CVE-2023-22745
Buffer Overlow in TSS2_RC_Decode in tpm2-tss
Medium 6.4

Affected Vendor

tpm2-software

View all reports →

Affected Software

tpm2-tools
Vulnerable Versions:
< 5.7

Timeline

Official Publish: June 28th, 2024
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-807

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.