CVE-2024-29039 Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2024-29039 and CVE-2024-29040 Vulnerabilities in TPM Reporting Two vulnerabilities, CVE-2024-29039 and CVE-2024-29040, were published on June 28, 2024, affecting Trusted Platform Module (TPM) implementations. CVE-2024-29039 allows attackers to misrepresent the TPM state due to a missing check, while CVE-2024-29040 fails to detect if a quote was not generated by the TPM. These vulnerabilities could lead to security breaches in systems relying on TPM for integrity verification. 2 sources 46