Security update for tpm2.0-tools, tpm2-0-tss SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20151-1 Final 1 1 2025-03-18T10:58:34Z current 2025-03-18T10:58:34Z 2025-03-18T10:58:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for tpm2.0-tools, tpm2-0-tss This update for tpm2.0-tools, tpm2-0-tss fixes the following issues: tpm2-0-tss: Update to version 4.1: + Security - CVE-2024-29040: arbitrary quote data may go undetected by Fapi_VerifyQuote (bsc#1223690) + Fixed - fapi: Fix length check on FAPI auth callbacks - mu: Correct error message for errors - tss2-rc: fix unknown laer handler dropping bits. - fapi: Fix deviation from CEL specification (template_value was used instead of template_data). - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c. - build: fix build fail after make clean. - mu: Fix unneeded size check in TPM2B unmarshaling. - fapi: Fix missing parameter encryption. - build: Fix failed build with --disable-vendor. - fapi: Fix flush of persistent handles. - fapi: Fix test provisioning with template with self generated certificate disabled. - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs. - fapi: Revert pcr extension for EV_NO_ACTION events. - fapi: Fix strange error messages if nv, ext, or policy path does not exits. - fapi: Fix segfault caused by wrong allocation of pcr policy. - esys: Fix leak in Esys_EvictControl for persistent handles. - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform. - esys: Add reference counting for Esys_TR_FromTPMPublic. - esys: Fix HMAC error if session bind key has an auth value with a trailing 0. - fapi: fix usage of self signed certificates in TPM. - fapi: Usage of self signed certificates. - fapi: A segfault after the error handling of non existing keys. - fapi: Fix several leaks. - fapi: Fix error handling for policy execution. - fapi: Fix usage of persistent handles (should not be flushed) - fapi: Fix test provisioning with template (skip test without self generated certificate). - fapi: Fix pcr extension for EV_NO_ACTION - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set - fapi: Fix read large system eventlog (> UINT16_MAX). - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0) - test: unit: tcti-libtpms: fix test failed at 32-bit platforms. - fapi: Fix possible null pointer dereferencing in Fapi_List. - sys: Fix size check in Tss2_Sys_GetCapability. - esys: Fix leak in Esys_TR_FromTPMPublic. - esys: fix unchecked return value in esys crypto. - fapi: Fix wrong usage of local variable in provisioning. - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize. - fapi: Fix possible out of bound array access in IMA parser. - tcti device: Fix possible unmarshalling from uninitialized variable. - fapi: Fix error checking authorization of signing key. - fapi: Fix cleanup of policy sessions. - fapi: Eventlog H-CRTM events and different localities. - fapi: Fix missing synchronization of quote and eventlog. - faii: Fix invalid free in Fapi_Quote with empty eventlog. + Added - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go. - mbedtls: add sha512 hmac. - fapi: Enable usage of external keys for Fapi_Encrypt. - fapi: Support download of AMD certificates. - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module. - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed. - rc: New TPM return codes added. - fapi: Further Nuvoton certificates added. - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec. - tcti: Add '/dev/tcm0' to default conf - fapi: New Nuvoton certificates added. - esys: Fix leak in Esys_TR_FromTPMPublic. + Removed - Testing on Ubuntu 18.04 as it's near EOL (May 2023). tpm2.0-tools: Update to version 5.7: + Security - CVE-2024-29038: arbitrary quote data may go undetected by tpm2_checkquote (bsc#1223687) - CVE-2024-29039: pcr selection value is not compared with the attest (bsc#1223689) + Fixed - Fix eventlog test - Fix issues with reading NV indexes - Fix context save error on tpm2_create - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail - when attempting to context save a flushed session. - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto. - tpm2_send: fix EOF detection on input stream. - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems. - tpm2_nvread: fix input handling no nv index. - Auth file: Ensure 0-termination when reading auths from a file. - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh. - cirrus.yml fix tss compilation with libtpms for FreeBSD. - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd. - options: fix TCTI handling to avoid failures for commands that should work with no options. - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed. + Added - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option) + Removed - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems. - tpm2_nvread: fix input handling no nv index. - Update to version 5.6 + tpm2_eventlog: * add H-CRTM event support * add support of efivar versions less than 38 * Add support to check for efivar/efivar.h manually * Minor formatting fixes * tpm2_eventlog: add support for replay with different StartupLocality * Fix pcr extension for EV_NO_ACTION * Extend test of yaml string representation * Use helper for printing a string dump * Fix upper bound on unique data size * Fix YAML string formatting + tpm2_policy: * Add support for parsing forward seal TPM values * Use forward seal values in creating policies * Move dgst_size in evaluate_populate_pcr_digests() * Allow more than 8 PCRs for sealing * Move dgst_size in evaluate_populate_pcr_digests * Allow more than 8 PCRs for sealing * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more PCRs + tpm2_encryptdecrypt: Fix pkcs7 padding stripping + tpm2_duplicate: * Support -a option for attributes * Add --key-algorithm option + tpm2_encodeobject: Use the correct -O option instead of -C + tpm2_unseal: Add qualifier static to enhance the privacy of unseal function + tpm2_sign: * Remove -m option which was added mistakenly * Revert sm2 sign and verifysignature + tpm2_createek: * Correct man page example * Fix usage of nonce * Fix integrating nonce + tpm2_clear: add more details about the action + tpm2_startauthsession: allow the file attribute for policy authorization. + tpm2_getekcertificate: Add AMD EK support + tpm2_ecdhzgen: Add public-key parameter + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure + Bug-fixes: * The readthedocs build failed with module 'jinja2' has no attribute 'contextfilter' a requirement file was added to fix this problem * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa implementation. This error can be avoided by switching off the optimization with pragma * Changed wrong function name of "Esys_Load" to "Esys_Load" * Function names beginning with Esys_ are wrongly written as Eys_ * Reading and writing a serialized persistent ESYS_TR handles * cirrus-ci update image-family to freebsd-13-2 from 13-1 + misc: * Change the default Python version to Python3 in the helper's code * Skip test which uses the sign operator for comparison in abrmd_policynv.sh * tools/tr_encode: Add a tool that can encode serialized ESYS_TR for persistent handles from the TPM2B_PUBLIC and the raw persistent TPM2_HANDLE * Add safe directory in config The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-250 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/ Link for SUSE-SU-2025:20151-1 https://lists.suse.com/pipermail/sle-security-updates/2025-June/021188.html E-Mail link for SUSE-SU-2025:20151-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1223687 SUSE Bug 1223687 https://bugzilla.suse.com/1223689 SUSE Bug 1223689 https://bugzilla.suse.com/1223690 SUSE Bug 1223690 https://www.suse.com/security/cve/CVE-2024-29038/ SUSE CVE CVE-2024-29038 page https://www.suse.com/security/cve/CVE-2024-29039/ SUSE CVE CVE-2024-29039 page https://www.suse.com/security/cve/CVE-2024-29040/ SUSE CVE CVE-2024-29040 page SUSE Linux Micro 6.0 libefivar1-38-3.1 libtss2-esys0-4.1.0-1.1 libtss2-fapi-common-4.1.0-1.1 libtss2-fapi1-4.1.0-1.1 libtss2-mu0-4.1.0-1.1 libtss2-rc0-4.1.0-1.1 libtss2-sys1-4.1.0-1.1 libtss2-tcti-device0-4.1.0-1.1 libtss2-tcti-spi-helper0-4.1.0-1.1 libtss2-tcti-spidev0-4.1.0-1.1 libtss2-tctildr0-4.1.0-1.1 tpm2-0-tss-4.1.0-1.1 tpm2.0-tools-5.7-1.1 libefivar1-38-3.1 as a component of SUSE Linux Micro 6.0 libtss2-esys0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-fapi-common-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-fapi1-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-mu0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-rc0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-sys1-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-tcti-device0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-tcti-spi-helper0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-tcti-spidev0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 libtss2-tctildr0-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 tpm2-0-tss-4.1.0-1.1 as a component of SUSE Linux Micro 6.0 tpm2.0-tools-5.7-1.1 as a component of SUSE Linux Micro 6.0 tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7. CVE-2024-29038 SUSE Linux Micro 6.0:libefivar1-38-3.1 SUSE Linux Micro 6.0:libtss2-esys0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi-common-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-mu0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-rc0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-sys1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-device0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spi-helper0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spidev0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tctildr0-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2-0-tss-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2.0-tools-5.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/ https://www.suse.com/security/cve/CVE-2024-29038.html CVE-2024-29038 https://bugzilla.suse.com/1223687 SUSE Bug 1223687 tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7. CVE-2024-29039 SUSE Linux Micro 6.0:libefivar1-38-3.1 SUSE Linux Micro 6.0:libtss2-esys0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi-common-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-mu0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-rc0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-sys1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-device0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spi-helper0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spidev0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tctildr0-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2-0-tss-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2.0-tools-5.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/ https://www.suse.com/security/cve/CVE-2024-29039.html CVE-2024-29039 https://bugzilla.suse.com/1223689 SUSE Bug 1223689 This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0. CVE-2024-29040 SUSE Linux Micro 6.0:libefivar1-38-3.1 SUSE Linux Micro 6.0:libtss2-esys0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi-common-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-fapi1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-mu0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-rc0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-sys1-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-device0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spi-helper0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tcti-spidev0-4.1.0-1.1 SUSE Linux Micro 6.0:libtss2-tctildr0-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2-0-tss-4.1.0-1.1 SUSE Linux Micro 6.0:tpm2.0-tools-5.7-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520151-1/ https://www.suse.com/security/cve/CVE-2024-29040.html CVE-2024-29040 https://bugzilla.suse.com/1223690 SUSE Bug 1223690