CVE-2026-12681

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003
https://github.com/google/go-attestation/releases/tag/v0.6.1
https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Validación Incorrecta de Índice, Posición u Offset Especificados en la Entrada en Google go-attestation. parseEfiSignatureList() no avanza el búfer más allá de los bytes del proveedor antes de leer las entradas. Para listas hashSHA256SigGUID, esto permite que los bytes de encabezado del proveedor controlados por el atacante se anexen a la lista de hashes SHA256 de confianza. Un registro de eventos TPM manipulado podría inyectar hashes SHA256 arbitrarios en la base de datos de mediciones de confianza del verificador, lo que permite a un verificador de atestación remota aceptar un estado de arranque comprometido. Este problema afecta a go-attestation: hasta 0.6.0.

Information

Published : 2026-06-24 02:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12681

Mitre link : CVE-2026-12681

CVE.ORG link : CVE-2026-12681

JSON object : View

Products Affected

No product.

CWE

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

{"id": "CVE-2026-12681", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12681", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T12:57:27.832740Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@google.com", "affectedData": [{"vendor": "Google", "product": "go-attestation", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.6.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T02:16:28.060", "references": [{"url": "https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003", "source": "cve-coordination@google.com"}, {"url": "https://github.com/google/go-attestation/releases/tag/v0.6.1", "source": "cve-coordination@google.com"}, {"url": "https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv", "source": "cve-coordination@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-1285"}]}], "descriptions": [{"lang": "en", "value": "Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. A crafted TPM event log could inject arbitrary SHA256 hashes into the verifier's trusted measurement database, enabling a remote attestation verifier to accept a compromised boot state. This issue affects go-attestation: through 0.6.0."}, {"lang": "es", "value": "Vulnerabilidad de Validaci\u00f3n Incorrecta de \u00cdndice, Posici\u00f3n u Offset Especificados en la Entrada en Google go-attestation. parseEfiSignatureList() no avanza el b\u00fafer m\u00e1s all\u00e1 de los bytes del proveedor antes de leer las entradas. Para listas hashSHA256SigGUID, esto permite que los bytes de encabezado del proveedor controlados por el atacante se anexen a la lista de hashes SHA256 de confianza. Un registro de eventos TPM manipulado podr\u00eda inyectar hashes SHA256 arbitrarios en la base de datos de mediciones de confianza del verificador, lo que permite a un verificador de atestaci\u00f3n remota aceptar un estado de arranque comprometido. Este problema afecta a go-attestation: hasta 0.6.0."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "cve-coordination@google.com"}