CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.

• CWE-20
• CWE-20

• https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774pThird Party Advisory
• https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774pThird Party Advisory

Published

Feb 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0310Heap buffer overflow in Task Manager in Google Chrome prior …8.8
• CVE-2022-0311Heap buffer overflow in Task Manager in Google Chrome prior …8.8
• CVE-2022-0313The Float menu WordPress plugin before 4.3.1 does not have C…4.3
• CVE-2022-0314The Nimble Page Builder WordPress plugin before 3.2.2 does n…6.1
• CVE-2022-0315Insecure Temporary File in GitHub repository horovod/horovod…7.5
• CVE-2022-0316The WeStand WordPress theme before 2.1, footysquare WordPres…9.8
• CVE-2022-0318Heap-based Buffer Overflow in vim/vim prior to 8.2.9.8
• CVE-2022-0319Out-of-bounds Read in vim/vim prior to 8.2.5.5
• CVE-2022-0320The Essential Addons for Elementor WordPress plugin before 5…9.8
• CVE-2022-0321The WP Voting Contest WordPress plugin before 3.0 does not s…6.1
• CVE-2022-0322A flaw was found in the sctp_make_strreset_req function in n…5.5
• CVE-2022-0323Improper Neutralization of Special Elements Used in a Templa…8.8