This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0.

The version of tpm2-tss installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29040 advisory.

  - This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack     (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM     Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in     the JSON structure. The verifier can receive a state which does not represent the actual, possibly     malicious state of the device under test. The malicious device might get access to data it shouldn't, or     can use services it shouldn't be able to. This issue has been patched in version 4.1.0. (CVE-2024-29040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack     (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM     Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in     the JSON structure. The verifier can receive a state which does not represent the actual, possibly     malicious state of the device under test. The malicious device might get access to data it shouldn't, or     can use services it shouldn't be able to.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack     (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM     Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in     the JSON structure. The verifier can receive a state which does not represent the actual, possibly     malicious state of the device under test. The malicious device might get access to data it shouldn't, or     can use services it shouldn't be able to. This issue has been patched in version 4.1.0.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack     (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM     Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in     the JSON structure. The verifier can receive a state which does not represent the actual, possibly     malicious state of the device under test. The malicious device might get access to data it shouldn't, or     can use services it shouldn't be able to.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the     attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote     data, which may not be detected by Fapi_VerifyQuote.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-703 advisory.

    tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote (CVE-2024-29040)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack     (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM     Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in     the JSON structure. The verifier can receive a state which does not represent the actual, possibly     malicious state of the device under test. The malicious device might get access to data it shouldn't, or     can use services it shouldn't be able to. This issue has been patched in version 4.1.0.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the tpm2-tss package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the     attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote     data, which may not be detected by Fapi_VerifyQuote.(CVE-2024-29040)

Tenable has extracted the preceding description block directly from the EulerOS tpm2-tss security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6796-1 advisory.

    Fergus Dall discovered that TPM2 Software Stack did not properly handle layer arrays. An attacker could     possibly use this issue to cause

    TPM2 Software Stack to crash, resulting in a denial of service, or

    possibly execute arbitrary code. (CVE-2023-22745)

    Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not

    validate the quote data after deserialization. An attacker could generate an arbitrary quote and cause     TPM2 Software Stack to have unknown behavior.

    (CVE-2024-29040)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1635-1 advisory.

  - tpm2-tss:      Fixed CVE-2024-29040  tpm2-tools:      Fixed CVE-2024-29038     Fixed CVE-2024-29039     (CVE-2024-29040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-4512dc54af advisory.

    tpm2-tss:

        Fixed CVE-2024-29040

    tpm2-tools:

        Fixed CVE-2024-29038         Fixed CVE-2024-29039


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-3265d70b61 advisory.

    tpm2-tss:

        Fixed CVE-2024-29040

    tpm2-tools:

        Fixed CVE-2024-29038         Fixed CVE-2024-29039


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-0c9d3b51d4 advisory.

    tpm2-tss:

        Fixed CVE-2024-29040

    tpm2-tools:

        Fixed CVE-2024-29038         Fixed CVE-2024-29039


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208843	CBL Mariner 2.0 Security Update: tpm2-tss (CVE-2024-29040)	Nessus	MarinerOS Local Security Checks	medium
206532	EulerOS Virtualization 2.12.0 : tpm2-tss (EulerOS-SA-2024-2339)	Nessus	Huawei Local Security Checks	medium
206517	EulerOS Virtualization 2.12.1 : tpm2-tss (EulerOS-SA-2024-2319)	Nessus	Huawei Local Security Checks	medium
205980	EulerOS Virtualization 2.11.1 : tpm2-tss (EulerOS-SA-2024-2163)	Nessus	Huawei Local Security Checks	medium
205951	EulerOS 2.0 SP12 : tpm2-tss (EulerOS-SA-2024-2229)	Nessus	Huawei Local Security Checks	medium
205934	EulerOS 2.0 SP12 : tpm2-tss (EulerOS-SA-2024-2253)	Nessus	Huawei Local Security Checks	medium
205919	EulerOS Virtualization 2.11.0 : tpm2-tss (EulerOS-SA-2024-2188)	Nessus	Huawei Local Security Checks	medium
205857	EulerOS Virtualization 2.10.0 : tpm2-tss (EulerOS-SA-2024-2131)	Nessus	Huawei Local Security Checks	medium
205825	EulerOS Virtualization 2.10.1 : tpm2-tss (EulerOS-SA-2024-2151)	Nessus	Huawei Local Security Checks	medium
205809	Amazon Linux 2023 : tpm2-tss, tpm2-tss-devel, tpm2-tss-fapi (ALAS2023-2024-703)	Nessus	Amazon Linux Local Security Checks	medium
205258	EulerOS 2.0 SP11 : tpm2-tss (EulerOS-SA-2024-2113)	Nessus	Huawei Local Security Checks	medium
205242	EulerOS 2.0 SP11 : tpm2-tss (EulerOS-SA-2024-2096)	Nessus	Huawei Local Security Checks	medium
202524	EulerOS 2.0 SP9 : tpm2-tss (EulerOS-SA-2024-1976)	Nessus	Huawei Local Security Checks	medium
202507	EulerOS 2.0 SP9 : tpm2-tss (EulerOS-SA-2024-1949)	Nessus	Huawei Local Security Checks	medium
202425	EulerOS 2.0 SP10 : tpm2-tss (EulerOS-SA-2024-1924)	Nessus	Huawei Local Security Checks	medium
202424	EulerOS 2.0 SP10 : tpm2-tss (EulerOS-SA-2024-1900)	Nessus	Huawei Local Security Checks	medium
198063	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : TPM2 Software Stack vulnerabilities (USN-6796-1)	Nessus	Ubuntu Local Security Checks	medium
197052	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tpm2-0-tss (SUSE-SU-2024:1635-1)	Nessus	SuSE Local Security Checks	medium
196938	Fedora 39 : tpm2-tools / tpm2-tss (2024-4512dc54af)	Nessus	Fedora Local Security Checks	critical
196935	Fedora 38 : tpm2-tools / tpm2-tss (2024-3265d70b61)	Nessus	Fedora Local Security Checks	critical
194901	Fedora 40 : tpm2-tools / tpm2-tss (2024-0c9d3b51d4)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2024-29040

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

critical