PT-2024-22690 · Unknown+6 · Tpm2-Tools+6

Akorb + 1 · Published 2024-04-30 · Updated 2025-10-22 · CVE-2024-29038

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions tpm2-tools versions prior to 5.7

Description The issue allows a malicious attacker to generate arbitrary quote data that is not detected by tpm2 checkquote. This is related to the Trusted Platform Module (TPM2.0) tools.

Recommendations For versions prior to 5.7, update to version 5.7 to resolve the issue. As a temporary workaround, consider restricting the use of the tpm2 checkquote function until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-1390

CWE-1283

Related Identifiers

ALSA-2024:9424

ALSA-2024_9424

ALT-PU-2024-7427

AZL-43018

BDU:2025-16173

CVE-2024-29038

GHSA-5495-C38W-GR6F

INFSA-2024_9424

MGASA-2024-0170

OESA-2024-2081

OESA-2024-2082

OESA-2024-2083

OPENSUSE-SU-2024:13926-1

OPENSUSE-SU-2024_1636-1

RHSA-2024:9424

RHSA-2024_9424

RLSA-2024:9424

SUSE-SU-2024:1636-1

SUSE-SU-2024:1636-2

SUSE-SU-2024_1636-1

SUSE-SU-2025:20151-1

Affected Products

Alt Linux

Almalinux

Debian

Red Hat

Rocky Linux

Suse

Tpm2-Tools

References · 54

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29038.json · Exploit
• https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-5495-c38w-gr6f · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2081 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-29038 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1636-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-29038 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13926-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20151-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16173 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29038 · Security Note
• https://errata.rockylinux.org/RLSA-2024:9424 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29039 · Security Note