google/go-attestation

google/go-attestation

Releases16

Frequency4 months 3 weeks

Last Release 8 months ago

Stars428

Libraries to abstract aspects of working with TPMs for the purposes of attestation

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-0317 ↗	Feb 4, 2022Friday, 4 February 2022, 23:15	4 MEDIUM	2.1 LOW
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.