CVE-2022-0317
published 2022-02-04CVE-2022-0317: An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing…
PriorityP49low3.3CVSS 3.1
AVLACLPRLUINSUCNILAN
EPSS
0.10%
0.8th percentile
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | google_go-attestation | >= 0 < 0.4.0 | 0.4.0 |
| go-attestation | < 0.3.3 | 0.3.3 | |
| google_llc | go-attestation | >= unspecified < 0.4.0 | 0.4.0 |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Improper input validation in github.com/google/go-attestation
osv·2022-07-15
CVE-2022-0317 Improper input validation in github.com/google/go-attestation
Improper input validation in github.com/google/go-attestation
A local attacker can defeat remotely-attested measured boot.
Improper input validation in AKPublic.Verify can cause it to succeed when provided with a maliciously-formed Quote over no/some PCRs. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker can couple this vulnerability with a maliciously-formed TCG log in Eventlog.Verify to spoof events in the TCG log, defeating remotely-attested measured-boot.
GHSA
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
ghsa·2022-02-01
CVE-2022-0317 [MEDIUM] CWE-20 Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
### Impact
An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.
### Patches
This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` ins
OSV
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
osv·2022-02-01
CVE-2022-0317 [MEDIUM] Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
Go-Attestation Improper Input Validation with attacker-controlled TPM Quote
### Impact
An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.
### Patches
This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` ins
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-02-04
Published