漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Improper Input Validation in AKPublic.Verify in go-attestation
Vulnerability Description
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vulnerability Type
输入验证不恰当
Vulnerability Title
go-attestation 输入验证错误漏洞
Vulnerability Description
Go-Attestation是用于抽象跨各种平台和 Tpm 的远程认证操作，从而实现了对计算机标识和状态的远程验证。 go-attestation 0.3.3 之前存在安全漏洞，该漏洞允许本地用户在没有/某些 PCR 上提供恶意格式的 Quote，导致 AKPublic.Verify 尽管存在不一致但仍然成功。
CVSS Information
N/A
Vulnerability Type
N/A