| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/google/go-attestation | < 0.4.0 | 0.4.0 |
| go-attestation | < 0.3.3 | 0.3.3 |
An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot.
This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method AKPublic.VerifyAll() instead of AKPublic.Verify.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free