https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:15:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329790 EUVD-2026-329790 https://cve.radiocsirt.org/vuln/euvd-2026-329790 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12681 <p>Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.</p> <p>Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12681 https://cve.radiocsirt.org/vuln/ghsa-9r4w-jg96-92mv <p><strong>Affected:</strong> Go: github.com/google/go-attestation</p> <p>## Summary</p> <p>`parseEfiSignatureList()` in `attest/internal/events.go` does not skip `SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST` signature entries, violating UEFI specification section 31.4.1.</p> <p>## Impact</p> <p>For `hashSHA256SigGUID` lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation.</p> <p>## Root Cause</p> <p>After `binary.Read(&amp;signatures.Header)` reads 28 bytes, `buf` points to the start of the `SignatureHeaderSize` vendor bytes. Both entry loops start at `sigOffset := 0` instead of `sigOffset := SignatureHeaderSize`, causing vendor bytes to be read as signature entries.</p> <p>## Affected versions</p> <p>All versions through commit `f877374` (2026-05-15).</p> <p>## Fix</p> <p>Pull request: https://github.com/google/go-attestation/pull/502</p> <p>- Add bound check: `SignatureHeaderSize` must not exceed remaining list space - Skip `SignatureHeaderSize` bytes before both entry loops - Regression test: `TestParseEfiSignatureListNonZeroSignatureHeaderSize`</p> <p><strong>Affected:</strong> Go: github.com/google/go-attestation</p> <p>## Summary</p> <p>`parseEfiSignatureList()` in `attest/internal/events.go` does not skip `SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST` signature entries, violating UEFI specification section 31.4.1.</p> <p>## Impact</p> <p>For `hashSHA256SigGUID` lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation.</p> <p>## Root Cause</p> <p>After `binary.Read(&amp;signatures.Header)` reads 28 bytes, `buf` points to the start of the `SignatureHeaderSize` vendor bytes. Both entry loops start at `sigOffset := 0` instead of `sigOffset := SignatureHeaderSize`, causing vendor bytes to be read as signature entries.</p> <p>## Affected versions</p> <p>All versions through commit `f877374` (2026-05-15).</p> <p>## Fix</p> <p>Pull request: https://github.com/google/go-attestation/pull/502</p> <p>- Add bound check: `SignatureHeaderSize` must not exceed remaining list space - Skip `SignatureHeaderSize` bytes before both entry loops - Regression test: `TestParseEfiSignatureListNonZeroSignatureHeaderSize`</p> https://cve.radiocsirt.org/vuln/ghsa-9r4w-jg96-92mv https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-12681 <p><strong>Affected:</strong> Ubuntu:26.04:LTS: golang-github-google-go-attestation</p> <p>Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.</p> <p><strong>Affected:</strong> Ubuntu:26.04:LTS: golang-github-google-go-attestation</p> <p>Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier&#39;s trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-12681