Vulnerability · Published Feb 4, 2022 · Assigned by Google
CVE-2022-0317Improper Input Validation in AKPublic.Verify in go-attestation
Medium 4.0
In plain English
A medium-severity improper input validation in go-attestation from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/google/go-attestation | 0.4.0 | GHSA-99cg-575x-774p |
| Go | github.com/google/go-attestation | 0.4.0 | GO-2022-0294 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | go-attestation | unspecified – before 0.4.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N