{"id":"CVE-2022-0317","summary":"Improper Input Validation in AKPublic.Verify in go-attestation","details":"An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.","aliases":["GHSA-99cg-575x-774p","GO-2022-0294"],"modified":"2026-07-15T01:49:11.148667936Z","published":"2022-02-04T22:33:03.136Z","database_specific":{"cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0317.json","cna_assigner":"Google"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0317.json"},{"type":"ADVISORY","url":"https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0317"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/go-attestation","events":[{"introduced":"0"},{"fixed":"82f2c9c2c76e1d3691d17ee78116d1d93a123788"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.4.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.3.2","v0.3.1","v0.3.0","v0.2.2","v0.2.1","v0.2.0","v0.1.3","v0.1.2","v0.1.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-0317.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}