CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317 Improper Input Validation in AKPublic.Verify in go-attestation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

CVE-2022-0317: Improper Input Validation

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

go-attestation 输入验证错误漏洞

Go-Attestation is used to abstract remote authentication operations across a variety of platforms and tpm's, thus enabling remote verification of computer identifiers and state. A security vulnerability existed prior to go-attestation 0.3.3 that allowed a local user to provide a maliciously...

Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

GHSA-99CG-575X-774P Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

PT-2022-13101

Name of the Vulnerable Software and Affected Versions go-attestation versions prior to 0.4.0 Description The issue is caused by improper input validation in AKPublic.Verify, allowing local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite th...

go-attestation:parse_event_log_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=4684920695947264 Project: go-attestation Fuzzing Engine: libFuzzer Fuzz Target: parseeventlogfuzzer Job Type: libfuzzerasango-attestation Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address...

go-attestation:parse_event_log_fuzzer: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=4728213731409920 Project: go-attestation Fuzzing Engine: libFuzzer Fuzz Target: parseeventlogfuzzer Job Type: libfuzzerasango-attestation Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreat...

go-attestation:parse_ak_public12_fuzzer: Segv on unknown address with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5124533432090624 Project: go-attestation Fuzzing Engine: libFuzzer Fuzz Target: parseakpublic12fuzzer Job Type: libfuzzerasango-attestation Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address...

go-attestation:parse_ek_certificate_fuzzer: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=6279937533411328 Project: go-attestation Fuzzing Engine: libFuzzer Fuzz Target: parseekcertificatefuzzer Job Type: libfuzzerasango-attestation Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000995166a Crash State: NULL Sanitizer:...