CVE-2024-29038

What it actually does

Improper input validation in tpm2 checkquote permits an attacker to supply arbitrary quote data that passes verification without corresponding to a genuine TPM-generated quote.

Why it matters to the business

Systems relying on TPM attestation for integrity or remote verification may accept falsified evidence of secure state, increasing risk of undetected compromise in environments that depend on hardware-rooted trust.

How an attack unfolds

An attacker generates fabricated quote data that mimics a valid TPM output. The data is submitted to tpm2 checkquote, which fails to detect the forgery because of insufficient validation, resulting in successful attestation of a non-genuine or compromised state.

How to fix it

Upgrade tpm2-tools to version 5.7 or later. On Debian 11 systems, install the fixed package version 5.10.216-1.

How to confirm the fix worked

Confirm the installed tpm2-tools version meets or exceeds 5.7. Test the checkquote command with known-invalid quote data to verify rejection occurs.

Typical attack path

1. Locate systems or processes that invoke tpm2 checkquote for TPM quote verification
2. Craft arbitrary quote data that bypasses the validation logic
3. Submit the forged quote through the affected command or API
4. Obtain false attestation success to evade detection or gain trust

How to detect it

Review command-line logs and audit trails for invocations of tpm2 checkquote; correlate with unexpected attestation successes or quote data originating from untrusted sources.

What your security team should do

• Prioritize upgrade of tpm2-tools to the patched version on all affected hosts
• Audit usage of tpm2 checkquote in attestation workflows and replace with validated alternatives where possible
• Monitor for any downstream package dependencies that pull in the vulnerable version