nsacyber / detect-cve-2017-15361-tpm Goto Github PK

/sys/class/tpm/tpm0/device/caps doesn't exist for TPM 2.0 in Linux-based systems. See tpm2-software/tpm2-tools#604 for more information.

We could try and detect if tpm2-tools is installed and then call tpm2_getcap -c="properties-fixed" if that returns the right data (manufacturer and firmware version). See https://github.com/tpm2-software/tpm2-tools/blob/master/man/tpm2_getcap.1.md for more information.

Looks like tpm2-tools 3.0+ uses tpm2_getcap. tpm2-tools 2.0 uses tpm2_dump_capability with the same arguments (ref https://manpages.debian.org/testing/tpm2-tools/tpm2_dump_capability.8.en.html). tpm2-tools 1.0 does not appear to have an equivalent command.

The script is currently trying to read /sys/class/tpm/tpm0/device/cap. However, according to https://www.kernel.org/doc/Documentation/ABI/stable/sysfs-class-tpm, the file's name is actually caps.