CVE-2022-0317: Improper Input Validation in AKPublic.Verify in go-attestation
Impact
An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot.
Patches This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.
Other sources
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/google/go-attestationto a version that resolves this vulnerability.Fixed in 0.4.0 - Upgrade
Upgrade
go-attestationto a version that resolves this vulnerability.Fixed in 0.4.0 - Configuration
When verifying PCRs using multiple quotes, use the new AKPublic.VerifyAll() method instead of AKPublic.Verify.
go-attestation AKPublic verification method = VerifyAll
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-0317.
What is the severity of CVE-2022-0317?
The severity of CVE-2022-0317 is medium with a severity value of 4.
What is the impact of CVE-2022-0317?
CVE-2022-0317 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency and subsequent use of the same set of PCR values in `Eventlog.Verify` lacks th…
What software is affected by CVE-2022-0317?
The affected software is go-attestation before version 0.4.0.
How do I fix CVE-2022-0317?
To fix CVE-2022-0317, upgrade to version 0.4.0 of go-attestation.