CVE-2022-29173: Improper Validation of Integrity Check Value in go-tuf
Summary
CVE-2022-29173: Version rollback attack in github.com/theupdateframework/go-tuf. Affects github.com/theupdateframework/go-tuf versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-tuf is an open-source Go library that implements the client-side of The Update Framework (TUF). TUF is a security framework designed to secure software update systems against various attacks. It provides a set of specifications and protocols for secure software distribution and update management. go-tuf is used by applications to securely update their software components. However, go-tuf versions prior to 0.3.0 are vulnerable to an improper validation of integrity check value vulnerability.
Vulnerability Detail
The vulnerability in go-tuf arises from the incorrect implementation of the client workflow for updating metadata files for roles other than the root role. This flaw allows an attacker to perform rollback attacks, where clients can be tricked into installing older software versions that may contain known vulnerabilities. The specific issues in go-tuf include:
- Failure to consider the content of previously trusted metadata when updating roles other than the root role, leading to version verification using a default value of zero.
- Saving timestamp and snapshot metadata files as trusted before verifying the correctness of the referenced metafiles' versions.
These issues can be exploited by an attacker to compromise the integrity and security of software updates.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
go get github.com/theupdateframework/go-tuf@v0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability apart from upgrading to the fixed version of go-tuf (0.3.0 or newer).
Conclusion
The vulnerability in go-tuf (CVE-2022-29173) exposes software update systems to rollback attacks, allowing attackers to install older software versions with known vulnerabilities. To mitigate this vulnerability, it is crucial to upgrade to go-tuf version 0.3.0 or newer. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/theupdateframework/go-tuf →
FAQ
go-tuf is an open-source Go library that implements the client-side of The Update Framework (TUF), a security framework for secure software distribution and update management.
A rollback attack is a type of attack where an attacker tricks a client into installing older software versions that may contain known vulnerabilities.
This vulnerability in go-tuf allows an attacker to compromise the integrity and security of software updates by tricking clients into installing older software versions with potential vulnerabilities.
No, there are no known workarounds for this vulnerability. The recommended solution is to upgrade to the fixed version of go-tuf (0.3.0 or newer).
For more information, you can visit the go-tuf GitHub repository and the TUF specification documentation. You can also reach out to the go-tuf community through their mailing list or the #tuf channel on CNCF Slack.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/theupdateframework/go-tuf.
