This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This issue has been patched in version 4.1.0.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tpm2-tss | Aug 22, 2024 | Jun 28, 2024 |
| Amazon_linux_2023 | — | Upgrade tpm2-tss-fapi-debuginfoUpgrade tpm2-tss-debuginfoUpgrade tpm2-tss-fapiUpgrade tpm2-tss-develUpgrade tpm2-tssUpgrade tpm2-tss-debugsource | Feb 17, 2025 | Apr 30, 2024 |
| Debian | — | Upgrade tpm2-tssNo solution exists | May 15, 2025 | Jun 28, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade tpm2-tss | Jul 16, 2024 | Jun 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade tpm2-tss | Oct 8, 2024 | Jun 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade tpm2-tss | Oct 8, 2024 | Jun 28, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade tpm2-tss | Jul 17, 2024 | Jun 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 28, 2024 |
| Suse | — | Upgrade libtss2-tcti-swtpm0Upgrade libtss2-tcti-mssim0-32bitUpgrade libtss2-esys0Upgrade libtss2-sys1-32bitUpgrade libtss2-rc0Upgrade libtss2-mu0-32bitUpgrade libtss2-tcti-device0Upgrade libtss2-tcti-mssim0Upgrade libtss2-tcti-cmd0Upgrade libtss2-fapi-commonUpgrade libtss2-sys1Upgrade libtss2-fapi1Upgrade libtss2-tcti-cmd0-32bitUpgrade tpm2-0-tssUpgrade libtss2-tcti-spi-helper0Upgrade libtss2-esys0-32bitUpgrade libtss2-tcti-i2c-helper0Upgrade libtss2-fapi1-32bitUpgrade libtss2-policy0Upgrade libtss2-tcti-pcap0Upgrade libtss2-tctildr0Upgrade libtss2-mu0Upgrade libtss2-tcti-device0-32bitUpgrade libtss2-tcti-swtpm0-32bitUpgrade libtss2-tctildr0-32bitUpgrade tpm2-0-tss-develUpgrade libtss2-tcti-spidev0Upgrade libtss2-rc0-32bit | May 15, 2024 | May 10, 2024 |
| Ubuntu | — | Upgrade libtss2-tcti-pcap0t64Upgrade libtss2-rc0t64Upgrade libtss2-fapi1Upgrade libtss2-tcti-libtpms0Upgrade libtss2-esys0Upgrade libtss2-fapi1t64Upgrade libtss2-sys1t64Upgrade libtss2-tcti-libtpms0t64Upgrade libtss2-tcti-swtpm0Upgrade libtss2-tctildr0t64Upgrade libtss2-policy0Upgrade libtss2-tcti-mssim0Upgrade libtss2-rc0Upgrade libtss2-sys1Upgrade libtss2-tcti-mssim0t64Upgrade libtss2-tcti-device0t64Upgrade libtss2-tcti-cmd0Upgrade libtss2-tcti-cmd0t64Upgrade libtss2-mu0Upgrade libtss2-tctildr0Upgrade libtss2-esys-3.0.2-0Upgrade libtss2-esys-3.0.2-0t64Upgrade libtss2-tcti-swtpm0t64Upgrade libtss2-tcti-pcap0Upgrade libtss2-policy0t64Upgrade libtss2-tcti-spi-helper0Upgrade libtss2-mu-4.0.1-0t64Upgrade libtss2-tcti-spi-helper0t64Upgrade libtss2-tcti-device0 | Jun 6, 2024 | May 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Jun 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub