Skip to content
OpenAdvisories
Critical RHSA-2024:9424 2 CVEs

Red Hat Security Advisory: tpm2-tools security update

Published Nov 12, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream tpm2-tools 0:5.2-4.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream tpm2-tools-debuginfo 0:5.2-4.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream tpm2-tools-debugsource 0:5.2-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos tpm2-tools 0:5.2-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos tpm2-tools-debuginfo 0:5.2-4.el9
Red Hat · RHEL 9 enterprise_linux:9::baseos tpm2-tools-debugsource 0:5.2-4.el9

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-29039

    Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

    tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped…

    tpm2-software tpm2-tools tpm2-tools tpm2-tools Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2024-29038

    tpm2 does not detect if quote was not generated by TPM

    tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

    tpm2-software tpm2-tools tpm2-tools tpm2-tools Debian Ubuntu Azure Linux Alpine

References

  • article
    https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
  • article
    https://access.redhat.com/security/updates/classification/#low
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278071
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2278075
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9424.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-29038
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-29038
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-29038
  • report
    https://access.redhat.com/security/cve/CVE-2024-29039
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-29039
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-29039