CVE-2024-29039

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. This issue has been patched in version 5.7.

• CWE-807

• https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7Release Notes
• https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6Exploit, Mitigation, Vendor Advisory
• https://github.com/tpm2-software/tpm2-tools/releases/tag/5.7Release Notes
• https://github.com/tpm2-software/tpm2-tools/security/advisories/GHSA-8rjm-5f5f-h4q6Exploit, Mitigation, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/

Published

Jun 28, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29033OAuthenticator provides plugins for JupyterHub to use common…9.1
• CVE-2024-29034CarrierWave is a solution for file uploads for Rails, Sinatr…6.1
• CVE-2024-29035Umbraco is an ASP.NET CMS. Failing webhooks logs are availab…5.3
• CVE-2024-29036Saleor Storefront is software for building e-commerce experi…6.5
• CVE-2024-29037datahub-helm provides the Kubernetes Helm charts for deployi…9.1
• CVE-2024-29038tpm2-tools is the source repository for the Trusted Platform…3.3
• CVE-2024-2904Cross-Site Request Forgery (CSRF) vulnerability in Extend Th…8.8
• CVE-2024-29040This repository hosts source code implementing the Trusted C…4.3
• CVE-2024-29041Express.js minimalist web framework for node. Versions of Ex…6.1
• CVE-2024-29042Translate is a package that allows users to convert text to …5.3
• CVE-2024-29043Microsoft ODBC Driver for SQL Server Remote Code Execution V…8.8
• CVE-2024-29044Microsoft OLE DB Driver for SQL Server Remote Code Execution…8.8