CVE-2022-0317 is an improper input validation vulnerability in google go-attestation versions prior to 0.3.3. This flaw allows a local attacker to bypass integrity checks by providing a malformed Quote, which can then be combined with a crafted TCG log to spoof measured-boot events. The vulnerability has a CVSS score of 3.3 (Low) with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating local access, low attack complexity, and a low impact on integrity. While it could defeat remotely-attested measured-boot, it requires local user privileges. There is currently no evidence of active exploitation, and no public exploit code or Metasploit modules are available. Community discussion and media coverage for this CVE are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 0.3.3CPE matchmatch criteria | cpe:2.3:a:google:go-attestation:*:*:*:*:*:*:*:* | ||
< 0.4.0CPE match | cpe:2.3:a:google:go-attestation:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.