GHSA-99cg-575x-774pMediumCVSS 4.0

Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Published
February 1, 2022
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

CVE-2022-0317 →

📋 Description

Impact

An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot.

Patches

This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.

🎯 Affected products1

  • go/github.com/google/go-attestation:< 0.4.0

🔗 References (5)