CVE-2022-0317

🗓️ 04 Feb 2022 22:33:03Reported by GoogleType

Improper input validation vuln in go-attestation before 0.3.3 allows local users to provide maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite inconsistency. Subsequent use of same set of PCR values in Eventlog.Verify lacks authentication performed by quote verification, enabling local attacker to spoof events in TCG log. Upgrade to Version 0.4.0 or above

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-0317	21 Apr 202514:02	–	circl
CNNVD	go-attestation 输入验证错误漏洞	4 Feb 202200:00	–	cnnvd
Cvelist	CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation	4 Feb 202222:33	–	cvelist
EUVD	EUVD-2022-0934	3 Oct 202520:07	–	euvd
Github Security Blog	Go-Attestation Improper Input Validation with attacker-controlled TPM Quote	1 Feb 202200:43	–	github
NVD	CVE-2022-0317	4 Feb 202223:15	–	nvd
OSV	CVE-2022-0317	4 Feb 202223:15	–	osv
OSV	GHSA-99CG-575X-774P Go-Attestation Improper Input Validation with attacker-controlled TPM Quote	1 Feb 202200:43	–	osv
OSV	GO-2022-0294 Improper input validation in github.com/google/go-attestation	15 Jul 202223:27	–	osv
Prion	Input validation	4 Feb 202223:15	–	prion

NVD

Vulners

Node

google go-attestationRange<0.3.3

[
  {
    "product": "go-attestation",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThan": "0.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p

21 Nov 2024 06:38Current

3.6Low risk

Vulners AI Score3.6

CVSS 22.1

CVSS 3.13.3 - 4

EPSS0.0004

SSVC

CWE-20