GitHub Advisoryadvisory · Go

GHSA-99cg-575x-774p Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

MEDIUM Published 2022-02-01 Modified 2023-08-29 Official page ↗
Aliases
CVE-2022-0317
Ecosystem
Go
Packages
github.com/google/go-attestation
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20
Reviewed
2022-01-31

Affected packages

• Go github.com/google/go-attestation: < 0.4.0 → fixed in 0.4.0

Description

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot. Patches This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.

Related

Alias · CVE (1)

  • CVE-2022-0317 An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References