CVE-2024-29039

What it actually does

Improper validation of TPML_PCR_SELECTION structures in PCR input files allows tpm2_checkquote to map digest values to incorrect PCR slots and banks, producing a falsified representation of TPM PCR state.

Why it matters to the business

Organizations relying on TPM-based remote attestation for boot integrity, measured boot, or device identity may accept compromised systems as trustworthy, increasing risk of undetected tampering in high-security environments.

How an attack unfolds

An attacker supplies a crafted PCR input file containing a manipulated TPML_PCR_SELECTION structure to tpm2_checkquote; the tool fails to validate the selection against the actual quote, causing incorrect digest-to-PCR mapping and a misleading attestation result that can be presented to relying parties.

How to fix it

Upgrade tpm2-tools to the commit c6e182cf690ca0022b77fe7d3c174659917a7e7e or later (corresponding to the 5.7 release) and rebuild any dependent tooling or containers.

How to confirm the fix worked

Run tpm2_checkquote against known-good and deliberately malformed PCR selection files; confirm that malformed selections are rejected and that output mappings match expected PCR banks after the upgrade.

Typical attack path

1. Obtain or generate a valid TPM quote from a target system
2. Craft a PCR input file with altered TPML_PCR_SELECTION values
3. Invoke tpm2_checkquote with the malicious input file
4. Receive and forward the incorrectly validated attestation result to a verifier

How to detect it

Search command-line histories, scripts, and logs for invocations of tpm2_checkquote that reference externally supplied PCR selection files; look for unexpected mismatches between reported PCR banks and the quote structure in attestation logs.

What your security team should do

• Immediately update all tpm2-tools installations to the fixed commit and verify the version in build pipelines and runtime images
• Review any attestation or integrity-checking workflows that consume tpm2_checkquote output and add independent validation of PCR selections where possible
• Monitor upstream tpm2-software repositories for related fixes in dependent libraries