GO-2022-0294

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2022-0294
Import Source
https://vuln.go.dev/ID/GO-2022-0294.json
JSON Data
https://api.test.osv.dev/v1/vulns/GO-2022-0294
Aliases
Published
2022-07-15T23:27:21Z
Modified
2024-05-20T16:03:47Z
Summary
Improper input validation in github.com/google/go-attestation
Details

A local attacker can defeat remotely-attested measured boot.

Improper input validation in AKPublic.Verify can cause it to succeed when provided with a maliciously-formed Quote over no/some PCRs. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker can couple this vulnerability with a maliciously-formed TCG log in Eventlog.Verify to spoof events in the TCG log, defeating remotely-attested measured-boot.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2022-0294"
}
References
Credits
    • Nikki VonHollen

Affected packages

Go / github.com/google/go-attestation

Package

Name
github.com/google/go-attestation
View open source insights on deps.dev
Purl
pkg:golang/github.com/google/go-attestation

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.4.0

Ecosystem specific 

{
    "imports": [
        {
            "path": "github.com/google/go-attestation/attest",
            "symbols": [
                "AKPublic.Verify",
                "AKPublic.validate12Quote",
                "AKPublic.validate20Quote",
                "TPM.AttestPlatform"
            ]
        }
    ]
}