6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9r4w-jg96-92mv

GHSA-9r4w-jg96-92mv: Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

Summary

parseEfiSignatureList() in attest/internal/events.go does not skip SignatureHeaderSize vendor bytes before reading EFI_SIGNATURE_LIST signature entries, violating UEFI specification section 31.4.1.

Impact

For hashSHA256SigGUID lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier's trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation.

Root Cause

After binary.Read(&signatures.Header) reads 28 bytes, buf points to the start of the SignatureHeaderSize vendor bytes. Both entry loops start at sigOffset := 0 instead of sigOffset := SignatureHeaderSize, causing vendor bytes to be read as signature entries.

Affected versions

All versions through commit f877374 (2026-05-15).

Fix

Pull request: https://github.com/google/go-attestation/pull/502

Add bound check: SignatureHeaderSize must not exceed remaining list space
Skip SignatureHeaderSize bytes before both entry loops
Regression test: TestParseEfiSignatureListNonZeroSignatureHeaderSize

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9r4w-jg96-92mv

GHSA-9r4w-jg96-92mv:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/google/go-attestation	go	<= 0.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided security patch (commit b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003) clearly identifies the vulnerable function and the nature of the vulnerability. The patch modifies attest/internal/events.go specifically within the parseEfiSignatureList function. The core of the vulnerability, as described and confirmed by the patch, is the failure to skip a variable-sized vendor-specific header (SignatureHeaderSize) within the EFI_SIGNATURE_LIST structure. The patch rectifies this by adding a bounds check for SignatureHeaderSize and then using io.Seeker.Seek to advance past these bytes before the loops that process the actual signature entries. The loop counters were also corrected to start after the vendor header. This directly points to parseEfiSignatureList as the function where the malformed data is processed, leading to the hash injection vulnerability.

Vulnerable functions

parseEfiSignatureList

attest/internal/events.go

The function `parseEfiSignatureList` is responsible for parsing EFI signature lists from a TPM event log. It failed to skip the `SignatureHeaderSize` bytes of vendor-specific data before reading the signature entries, as specified by the UEFI specification. This flaw allowed attacker-controlled data in the vendor header to be misinterpreted as signature entries, leading to the injection of arbitrary hashes into the trusted measurement list. This compromises the integrity of the remote attestation process by allowing a tampered boot state to be accepted as valid.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.