CVE-2024-29040

A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by Fapi_VerifyQuote.

This vulnerability is rated as moderate because it allows an attacker to generate arbitrary quote data, potentially bypassing Fapi_VerifyQuote detection, but it requires specific conditions to be exploited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.