CVE-2020-8918

An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and 'encMigrationAuth', and then can calculate 'usageAuth ^ encMigrationAuth' as the 'migrationAuth' can be guessed for all keys created with CreateWrapKey. TPM2.0 is not impacted by this. We recommend updating your library to 0.3.0 or later, or, if you cannot update, to call CreateWrapKey with a random 20-byte value for 'migrationAuth'.

• CWE-665
• CWE-665

• https://github.com/google/go-tpm/security/advisories/GHSA-5x29-3hr9-6wpwExploit, Third Party Advisory
• https://github.com/google/go-tpm/security/advisories/GHSA-5x29-3hr9-6wpwExploit, Third Party Advisory

Published

Aug 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8908A temp directory creation vulnerability exists in all versio…3.3
• CVE-2020-8910A URL parsing issue in goog.uri of the Google Closure Librar…6.5
• CVE-2020-8911A padding oracle vulnerability exists in the AWS S3 Crypto S…5.6
• CVE-2020-8912A vulnerability in the in-band key negotiation exists in the…2.5
• CVE-2020-8913A local, arbitrary code execution vulnerability exists in th…8.8
• CVE-2020-8916A memory leak in Openthread's wpantund versions up to commit…5.5
• CVE-2020-8919An information leak vulnerability exists in Gerrit versions …3.5
• CVE-2020-8920An information leak vulnerability exists in Gerrit versions …3.5
• CVE-2020-8923An improper HTML sanitization in Dart versions up to and inc…6.1
• CVE-2020-8927A buffer overflow exists in the Brotli library versions prio…6.5
• CVE-2020-8929A mis-handling of invalid unicode characters in the Java imp…5.3
• CVE-2020-8933A vulnerability in Google Cloud Platform's guest-oslogin ver…7.8