CVE-2024-13745
Public on 2026-05-29
Modified on 2026-05-29
Description
The bug allows an attacker to make the TPM record and measure one partition table layout while the firmware and operating system actually use a different layout.
This breaks the trustworthiness of TPM PCR[5] measurements, which are commonly used for:
TPM-based full disk encryption (FDE)
Remote attestation
Secure boot integrity validation
In practice, the system may appear “trusted” according to TPM measurements even though a malicious partition layout is being used.
This breaks the trustworthiness of TPM PCR[5] measurements, which are commonly used for:
TPM-based full disk encryption (FDE)
Remote attestation
Secure boot integrity validation
In practice, the system may appear “trusted” according to TPM measurements even though a malicious partition layout is being used.
Severity
See what this means
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | edk2 | Pending Fix |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 6.0 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N |