CVE-2024-29040

What it actually does

Improper input validation in Fapi_VerifyQuote allows the TPM2_GENERATED magic field of the deserialized TPMS_ATTEST structure to accept arbitrary values from JSON Quote Info produced by Fapi_Quote, bypassing checks that the reported state matches the actual device state.

Why it matters to the business

Organizations relying on TPM-based attestation for device identity or access control may grant data access or service permissions to compromised or malicious devices that should be denied, increasing risk of unauthorized data exposure or lateral movement.

How an attack unfolds

An attacker controlling a device under attestation crafts a JSON quote response containing an arbitrary or attacker-chosen TPM2_GENERATED magic value; the verifier calling Fapi_VerifyQuote accepts the malformed structure without validation, treating the malicious device state as authentic and granting access to protected resources.

How to fix it

Upgrade the TPM2 TSS library to version 4.1.0 or later where the deserialization of the TPM2_GENERATED magic field now enforces the expected constant value; rebuild and redeploy any applications statically or dynamically linking the affected library.

How to confirm the fix worked

Confirm the installed tpm2-tss package or library reports version 4.1.0 or newer; re-run attestation flows with a test device supplying an invalid magic value and verify the verifier now rejects the quote.

Typical attack path

1. Identify a system or service that performs remote attestation using Fapi_Quote and Fapi_VerifyQuote from the TPM2 TSS library
2. Compromise or emulate a target device to control quote generation
3. Craft and return a JSON quote with an invalid or attacker-supplied magic value in the TPMS_ATTEST structure
4. Submit the quote to the verifier which deserializes without enforcing the expected magic constant
5. Obtain access to data or services that the verifier would otherwise deny based on correct attestation

How to detect it

Review application or attestation service logs for Fapi_VerifyQuote calls that succeed despite receiving JSON structures containing unexpected or non-standard magic values; look for attestation success events followed by access to protected resources from devices whose reported PCRs or state later prove inconsistent.

What your security team should do

• Prioritize upgrade of tpm2-tss to 4.1.0 across all attestation-dependent systems within the next maintenance window
• Audit code and configurations that invoke Fapi_VerifyQuote to ensure they treat verification failures as hard denials
• Add monitoring for unexpected attestation failures or repeated quote submissions from the same device identifiers