Skip to content
OpenAdvisories
Medium ALAS2023-2024-703 1 CVE

Moderate: tpm2-tss security update (Amazon Linux 2023)

Published Aug 14, 2024 · Updated Aug 19, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-29040: tpm2-tss: arbitrary quote data may go undetected by Fapi_VerifyQuote

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2023 tpm2-tss 0:4.0.2-1.amzn2023
Amazon Linux · 2023 tpm2-tss-debuginfo 0:4.0.2-1.amzn2023
Amazon Linux · 2023 tpm2-tss-debugsource 0:4.0.2-1.amzn2023
Amazon Linux · 2023 tpm2-tss-devel 0:4.0.2-1.amzn2023
Amazon Linux · 2023 tpm2-tss-fapi 0:4.0.2-1.amzn2023
Amazon Linux · 2023 tpm2-tss-fapi-debuginfo 0:4.0.2-1.amzn2023

Vulnerabilities 1

  • Medium 4.3
    CVE-2024-29040

    Fapi Verify Quote: Does not detect if quote was not generated by TPM

    This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERAT…

    tpm2-software tpm2-tss tpm2-tss tpm2-tss Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-29040.html