CVE-2022-0317: Improper Input Validation in go-attestation allows local attackers to spoof events in the TCG log
Summary
CVE-2022-0317: Go-Attestation Improper Input Validation with attacker-controlled TPM Quote. Affects github.com/google/go-attestation versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-attestation is a Go library that provides an interface to the Trusted Computing Group (TCG) Attestation API. It allows developers to verify the integrity of a system's boot process by checking the values of Platform Configuration Registers (PCRs) and the Event Log. The library is commonly used for remotely attested measured-boot scenarios.
Vulnerability Detail
An improper input validation vulnerability in go-attestation before version 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. This vulnerability can be exploited by a local attacker to couple it with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log. This defeats remotely-attested measured-boot, compromising the integrity of the system's boot process.
How To Fix
Minimum fixed version
0.4.0
This is the first release that contains the fix.
go get github.com/google/go-attestation@v0.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the library.
Conclusion
The improper input validation vulnerability in go-attestation can be exploited by local attackers to spoof events in the TCG log, compromising the integrity of the system's boot process. It is recommended to upgrade to version 0.4.0 of the library and use the new method AKPublic.VerifyAll() to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/google/go-attestation →
FAQ
go-attestation is a Go library that provides an interface to the Trusted Computing Group (TCG) Attestation API. It is commonly used for verifying the integrity of a system's boot process.
The vulnerability allows local attackers to spoof events in the TCG log, compromising the integrity of the system's boot process.
To fix this vulnerability, upgrade to version 0.4.0 of go-attestation and use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the library.
For more information about this vulnerability, you can refer to the CVE-2022-0317 advisory or contact the library maintainers.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/go-attestation.
