GHSA-99CG-575X-774P中危已审查

Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

OSV 1.4.0 · github-reviewed · 修改于 2023-08-30 04:29

发布时间

2022-02-01 08:43

GitHub 审查时间

2022-02-01 06:15

NVD 发布时间

2022-02-05 07:15

源文件

advisories/github-reviewed/2022/02/GHSA-99cg-575x-774p/GHSA-99cg-575x-774p.json

公告说明

Impact

An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot.

Patches

This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.

受影响的软件包

github.com/google/go-attestation

ECOSYSTEM

标识信息

别名 / CVE

CVE-2022-0317

CWE

CWE-20

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-99cg-575x-774p",
  "aliases": [
    "CVE-2022-0317"
  ],
  "details": "### Impact\n\nAn improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.\n\n### Patches\nThis issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.",
  "summary": "Go-Attestation Improper Input Validation with attacker-controlled TPM Quote",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/google/go-attestation",
        "ecosystem": "Go"
      }
    }
  ],
  "modified": "2023-08-29T20:29:19Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
    }
  ],
  "published": "2022-02-01T00:43:17Z",
  "references": [
    {
      "url": "https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0317",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/google/go-attestation/commit/82f2c9c2c76e1d3691d17ee78116d1d93a123788",
      "type": "WEB"
    },
    {
      "url": "https://github.com/google/go-attestation",
      "type": "WEB"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-0294",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2022-02-04T23:15:00Z",
    "github_reviewed_at": "2022-01-31T22:15:30Z"
  }
}