CVE-2022-0317mediumCWE-20

CVE-2022-0317: falha de média gravidade em Google LLC go-attestation

Improper Input Validation in AKPublic.Verify in go-attestation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar go-attestation+ Monitorar github.com/google/go-attestation

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4epss 0.1%
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Google LLC · go-attestation