[SECURITY] Fedora 34 Update: keylime-6.3.0-2.fc34

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

Fedora: Security Advisory for keylime (FEDORA-2022-dbb274913a)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for keylime (FEDORA-2022-5770dad5f8)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

go-attestation 输入验证错误漏洞

Go-Attestation is used to abstract remote authentication operations across a variety of platforms and tpm's, thus enabling remote verification of computer identifiers and state. A security vulnerability existed prior to go-attestation 0.3.3 that allowed a local user to provide a maliciously...

Insecure Remote Attestation

github.com/google/go-attestation is vulnerable to insecure remote attestation. The use code generated from Platform Configuration Register PCR in trusted platform module TPM allows a local attacker who performs TCG log in Eventlog.Verify to spoof events in the TCG log and bypassing the method...

GHSA-99CG-575X-774P Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

Go-Attestation Improper Input Validation with attacker-controlled TPM Quote

Impact An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...

Microsoft Warns of New Security Flaw Affecting Surface Pro 3 Devices

Microsoft has published a new advisory warning of a security bypass vulnerability affecting Surface Pro 3 convertible laptops that could be exploited by an adversary to introduce malicious devices within enterprise networks and defeat the device attestation mechanism. Tracked as CVE-2021-42299 CV...

CVE-2021-41087

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries i.e., within a trusted set of users for a layout are able to create attestations that may bypass DISALLOW rules in the sa...

2021.1 IPU - Intel Atom® Processor Advisory

Summary: A potential security vulnerability in some Intel Atom® Processors may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2020-24513 Description: Domain-bypass transient execution vulnerability in...

Intel® IPP and SGX Software Advisory

Summary: A potential security vulnerability in the Intel® Integrated Performance Primitives IPP Crypto Library may allow information disclosure. Intel® IPP is used by Intel® Software Guard Extension SGX, and Intel is releasing software updates to mitigate this potential vulnerability. Vulnerabili...

CVE-2021-26311

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to...

Design/Logic Flaw

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to...

CVE-2021-26311

CVE-2021-26311 concerns AMD SEV/SEV-ES where memory can be rearranged in the guest address space without attestation detection, potentially enabling arbitrary code execution in a guest VM if a malicious administrator with server-hypervisor access acts. Documents cite the vulnerability in SEV/SEV-...

CVE-2021-26311 AMD Secure Encrypted Virtualization

In the AMD SEV/SEV-ES feature, memory can be rearranged in the guest address space that is not detected by the attestation mechanism which could be used by a malicious hypervisor to potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to...

Intel® Processors Load Value Injection Advisory

Summary: Potential security vulnerabilities in some Intel® Processors may allow information disclosure. Intel and others are releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2020-0551 Description: Load value injection in some IntelR...

Microarchitectural Data Sampling Advisory

Summary: A potential security vulnerability in CPUs may allow information disclosure. Intel is releasing Microcode Updates MCU updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12126 Microarchitectural Store Buffer Data Sampling MSBDS: Store buffers on some...

Fedora: Security Advisory for keylime (FEDORA-2021-b7854ccfe4)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: keylime-6.0.0-1.fc34

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

Fedora: Security Advisory for keylime (FEDORA-2021-11e4ae96a7)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...