GHSA-99cg-575x-774p

    Dashboard / Vulnerabilities / GHSA-99cg-575x-774p

    GHSA-99cg-575x-774p

    Published: 1 Feb 2022Last Modified: 4 May 2026

    Summary: Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

    Details: ### Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot. ### Patches This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.

    References: https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p, https://nvd.nist.gov/vuln/detail/CVE-2022-0317, https://github.com/google/go-attestation/commit/82f2c9c2c76e1d3691d17ee78116d1d93a123788, https://github.com/google/go-attestation, https://pkg.go.dev/vuln/GO-2022-0294

    Affected packages

    Package

    Name: github.com/google/go-attestation

    Purl: pkg:golang/github.com/google/go-attestation

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.4.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-99cg-575x-774p | CVE-DB