Description
This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This
issue has been patched in version 4.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tpm2-software | tpm2-tss | < 4.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tpm2-tss | 4.1.0-1 | — |
| Debian 13 | tpm2-tss | 4.1.0-1 | — |
| Debian 12 | tpm2-tss | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | tpm2-tss | 4.0.1-7.1ubuntu5.1 | USN-6796-1 |
| Ubuntu 22.04 LTS | tpm2-tss | 3.2.0-1ubuntu1.1 | USN-6796-1 |
| Ubuntu 20.04 LTS | tpm2-tss | 2.3.2-1ubuntu0.20.04.2 | USN-6796-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | efivar | 38-3.1 | SUSE-SU-2025:20151-1 |
| SLE Micro 6.0 | tpm2-0-tss | 4.1.0-1.1 | SUSE-SU-2025:20151-1 |
| SLE Micro 6.0 | tpm2.0-tools | 5.7-1.1 | SUSE-SU-2025:20151-1 |
| SLE Micro 5.5 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-2, SUSE-SU-2024:1635-1 |
| SLE Micro 5.4 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
| SLE Micro 5.3 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
| openSUSE Leap Micro 5.3 | tpm2-0-tss | 3.1.0-150400.3.6.1 | SUSE-SU-2024:1635-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | tpm2-tss | 4.1.1-r0 | — |
| Alpine v3.23 | tpm2-tss | 4.1.1-r0 | — |
| Alpine v3.22 | tpm2-tss | 4.1.1-r0 | — |
| Alpine v3.21 | tpm2-tss | 4.1.1-r0 | — |
| Alpine v3.20 | tpm2-tss | 4.1.1-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | tpm2-tss | 4.0.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | tpm2-tss +2 | 4.0.2-1.amzn2023 | ALAS2023-2024-703 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | tpm2-tss | 4.0.2-1 | — |
| Azure Linux 2 (CBL-Mariner) | tpm2-tss | 2.4.6-4 | — |
Advisories 6
- WID-SEC-2026-0778 Dell Secure Connect Gateway Policy Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- USN-6796-1 tpm2-tss vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- SUSE-SU-2025:20151-1 Security update for tpm2.0-tools, tpm2-0-tss SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2024:1635-2 Security update for tpm2-0-tss SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1635-1 Security update for tpm2-0-tss SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2023-2024-703 Moderate: tpm2-tss security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 19, 2024