TPM 2.0 (S3 sleep PCR reset): Platform Configuration Registers can be reset without a full platform restart by abusing

Impact

Platform Configuration Registers can be reset without a full platform restart by abusing the S3 sleep path, letting an attacker replay chosen measurements into a TPM that should only ever accumulate them. The effect is that a machine which booted a tampered image can present PCR values identical to a clean boot, defeating sealed-storage unlock policies and remote attestation. Any control you built on 'the PCRs cannot lie' stops holding.

Who can reach it

Local attacker with the ability to put the system into and out of S3 sleep - so a tenant with root on a bare-metal node, or anyone with console access.

What to do

Platform firmware/BIOS update from the OEM (per node, reboot required) that correctly re-establishes the static root of trust across sleep. Practical compensating control on servers: disable S3 suspend entirely in BIOS, which most datacenter nodes never use anyway - a config-only change that eliminates the trigger. Do that first, then patch on the normal cycle.

References