Google go-tpm TPM1.2 Library up to 0.2.x migrationAuth initialization

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Google go-tpm TPM1.2 Library up to 0.2.x. This vulnerability affects unknown code. Performing a manipulation of the argument migrationAuth results in initialization. This vulnerability is reported as CVE-2020-8918. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google go-tpm TPM1.2 Library up to 0.2.x (Programming Language Software). It has been classified as problematic. This affects an unknown functionality. The manipulation of the argument migrationAuth with an unknown input leads to a initialization vulnerability. CWE is classifying the issue as CWE-665. The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used. This is going to have an impact on confidentiality. The summary by CVE is:

An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and 'encMigrationAuth', and then can calculate 'usageAuth ^ encMigrationAuth' as the 'migrationAuth' can be guessed for all keys created with CreateWrapKey. TPM2.0 is not impacted by this. We recommend updating your library to 0.3.0 or later, or, if you cannot update, to call CreateWrapKey with a random 20-byte value for 'migrationAuth'.

The weakness was disclosed 08/11/2020 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2020-8918 since 02/12/2020. The exploitability is told to be difficult. An attack has to be approached locally. The successful exploitation needs a authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 0.3.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• go-tpm TPM1.2 Library

Version

• 0.1
• 0.2

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion