CVE-2024-29039: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2024-29039) affects tpm2-tools, which is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability was discovered in versions prior to 5.7 and allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. The issue was disclosed in June 2024 and has been patched in version 5.7 (GitHub Advisory, NVD).

The vulnerability stems from a missing validation check in the tpm2_checkquote tool. While the tool verifies that the pcrDigest from the quote matches the digest of concatenated PCRs from the PCR input file, it fails to verify that the PCR selection of the PCR input file matches the one included in the quote. This oversight allows attackers to craft PCR input files with arbitrary TPML_PCR_SELECTION values. The vulnerability has been assigned a CVSS v3.1 base score of 9.0 CRITICAL with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (GitHub Advisory).

As a result of this vulnerability, digest values can be incorrectly mapped to PCR slots and banks, providing a misleading picture of the TPM state. An attacker can swap a compatible selection for another, causing TPM register values to be associated with the wrong PCR index or bank. The vulnerability also extends to the reinterpretation of data across PCR banks and their corresponding hashing algorithms (GitHub Advisory).

The vulnerability is described as relatively easy to exploit, though less severe than related vulnerabilities. It can be exploited by manipulating the PCR input file, which is treated as untrusted data. The attack requires crafting specific PCR input files that maintain matching digest concatenations while altering the PCR selection information (GitHub Advisory).

The vulnerability has been patched in tpm2-tools version 5.7. Users are advised to upgrade to this version or later to address the security issue. The fix includes proper validation of PCR selection data (GitHub Release, Red Hat Advisory).