CVE-2022-0317
Description
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
How to fix
- google go-attestation0.3.3 or later
- github.com/google/go-attestation0.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google go-attestation | v < 0.3.3 | 0.3.3 |
| github.com/google/go-attestationGo | v < 0.4.0 | 0.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.