Headline
Ubuntu Security Notice USN-6796-1
Ubuntu Security Notice 6796-1 - Fergus Dall discovered that TPM2 Software Stack did not properly handle layer arrays. An attacker could possibly use this issue to cause TPM2 Software Stack to crash, resulting in a denial of service, or possibly execute arbitrary code. Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not validate the quote data after deserialization. An attacker could generate an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.
==========================================================================
Ubuntu Security Notice USN-6796-1
May 29, 2024
tpm2-tss vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in TPM2 Software Stack.
Software Description:
- tpm2-tss: TPM2 Software Stack library
Details:
Fergus Dall discovered that TPM2 Software Stack did not properly handle
layer arrays. An attacker could possibly use this issue to cause
TPM2 Software Stack to crash, resulting in a denial of service, or
possibly execute arbitrary code.
(CVE-2023-22745)
Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not
validate the quote data after deserialization. An attacker could generate
an arbitrary quote and cause TPM2 Software Stack to have unknown behavior.
(CVE-2024-29040)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libtss2-esys-3.0.2-0t64 4.0.1-7.1ubuntu5.1
libtss2-fapi1t64 4.0.1-7.1ubuntu5.1
libtss2-mu-4.0.1-0t64 4.0.1-7.1ubuntu5.1
libtss2-policy0t64 4.0.1-7.1ubuntu5.1
libtss2-rc0t64 4.0.1-7.1ubuntu5.1
libtss2-sys1t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-cmd0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-device0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-libtpms0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-mssim0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-pcap0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-spi-helper0t64 4.0.1-7.1ubuntu5.1
libtss2-tcti-swtpm0t64 4.0.1-7.1ubuntu5.1
libtss2-tctildr0t64 4.0.1-7.1ubuntu5.1
Ubuntu 23.10
libtss2-esys-3.0.2-0 4.0.1-3ubuntu1.1
libtss2-fapi1 4.0.1-3ubuntu1.1
libtss2-mu0 4.0.1-3ubuntu1.1
libtss2-policy0 4.0.1-3ubuntu1.1
libtss2-rc0 4.0.1-3ubuntu1.1
libtss2-sys1 4.0.1-3ubuntu1.1
libtss2-tcti-cmd0 4.0.1-3ubuntu1.1
libtss2-tcti-device0 4.0.1-3ubuntu1.1
libtss2-tcti-libtpms0 4.0.1-3ubuntu1.1
libtss2-tcti-mssim0 4.0.1-3ubuntu1.1
libtss2-tcti-pcap0 4.0.1-3ubuntu1.1
libtss2-tcti-spi-helper0 4.0.1-3ubuntu1.1
libtss2-tcti-swtpm0 4.0.1-3ubuntu1.1
libtss2-tctildr0 4.0.1-3ubuntu1.1
Ubuntu 22.04 LTS
libtss2-esys-3.0.2-0 3.2.0-1ubuntu1.1
libtss2-fapi1 3.2.0-1ubuntu1.1
libtss2-mu0 3.2.0-1ubuntu1.1
libtss2-rc0 3.2.0-1ubuntu1.1
libtss2-sys1 3.2.0-1ubuntu1.1
libtss2-tcti-cmd0 3.2.0-1ubuntu1.1
libtss2-tcti-device0 3.2.0-1ubuntu1.1
libtss2-tcti-mssim0 3.2.0-1ubuntu1.1
libtss2-tcti-swtpm0 3.2.0-1ubuntu1.1
libtss2-tctildr0 3.2.0-1ubuntu1.1
Ubuntu 20.04 LTS
libtss2-esys0 2.3.2-1ubuntu0.20.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6796-1
CVE-2023-22745, CVE-2024-29040
Package Information:
https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-7.1ubuntu5.1
https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-3ubuntu1.1
https://launchpad.net/ubuntu/+source/tpm2-tss/3.2.0-1ubuntu1.1
https://launchpad.net/ubuntu/+source/tpm2-tss/2.3.2-1ubuntu0.20.04.2
Related news
Red Hat Security Advisory 2024-4408-03 - An update for tpm2-tss is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.
Red Hat Security Advisory 2023-7166-01 - An update for tpm2-tss is now available for Red Hat Enterprise Linux 8.
tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege.