{"id":"CVE-2022-0317","aliases":["EUVD-2022-0934","GHSA-99cg-575x-774p","GO-2022-0294"],"status":"published","title":"Improper Input Validation in AKPublic.Verify in go-attestation","description":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00096,"percentile":0.00687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-02-01T00:43:17Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Go","package":"github.com/google/go-attestation","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/google/go-attestation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/go-attestation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/go-attestation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]}],"products":[{"vendor":"google","product":"go-attestation"},{"vendor":"google llc","product":"go-attestation"}],"references":[{"url":"https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/google/go-attestation/commit/82f2c9c2c76e1d3691d17ee78116d1d93a123788","tags":["web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0317","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0294","tags":["web"]},{"url":"https://github.com/advisories/GHSA-99cg-575x-774p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0317.json","tags":["advisory"]},{"url":"https://github.com/google/go-attestation","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-0317","title":"Improper Input Validation in AKPublic.Verify in go-attestation","description":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","status":"published","published":"2022-02-04T22:33:03.136Z","modified":"2025-04-21T13:56:50.11Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:42.028422Z"}],"euvd":[{"id":"EUVD-2022-0934","description":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","status":"published","published":"2022-02-04T22:33:03Z","modified":"2025-04-21T13:56:50Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-99cg-575x-774p","title":"Go-Attestation Improper Input Validation with attacker-controlled TPM Quote","description":"### Impact\n\nAn improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.\n\n### Patches\nThis issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.","status":"published","published":"2022-02-01T00:43:17Z","modified":"2023-08-29T20:29:19Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2022-0317","description":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","status":"published","published":"2022-02-04T23:15:12.51Z","modified":"2026-06-17T04:20:23.133Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"CVE-2022-0317","title":"Improper Input Validation in AKPublic.Verify in go-attestation","description":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","status":"published","published":"2022-02-04T22:33:03.136Z","modified":"2026-10-28T02:31:08.976747452Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"GHSA-99cg-575x-774p","title":"Go-Attestation Improper Input Validation with attacker-controlled TPM Quote","description":"### Impact\n\nAn improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.\n\n### Patches\nThis issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.","status":"published","published":"2022-02-01T00:43:17Z","modified":"2026-05-04T08:46:07.220262724Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"GO-2022-0294","title":"Improper input validation in github.com/google/go-attestation","description":"A local attacker can defeat remotely-attested measured boot.\n\nImproper input validation in AKPublic.Verify can cause it to succeed when provided with a maliciously-formed Quote over no/some PCRs. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker can couple this vulnerability with a maliciously-formed TCG log in Eventlog.Verify to spoof events in the TCG log, defeating remotely-attested measured-boot.","status":"published","published":"2022-07-15T23:27:21Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}