{"id":"GHSA-9r4w-jg96-92mv","revision":"3003edbb6da0452984c7018cf5a80f01","records":[{"revision":"3003edbb6da0452984c7018cf5a80f01","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9r4w-jg96-92mv","aliases":["CVE-2026-12681","GO-2026-5298"],"title":"Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()","description":"## Summary\n\n`parseEfiSignatureList()` in `attest/internal/events.go` does not skip\n`SignatureHeaderSize` vendor bytes before reading `EFI_SIGNATURE_LIST`\nsignature entries, violating UEFI specification section 31.4.1.\n\n## Impact\n\nFor `hashSHA256SigGUID` lists, attacker-controlled vendor header bytes are appended directly to the trusted SHA256 hash list. A crafted TPM event log can inject arbitrary SHA256 hashes into the verifier's trusted measurement database, allowing a remote attestation verifier to accept a compromised boot state as legitimate — breaking the core integrity guarantee of remote attestation.\n\n## Root Cause\n\nAfter `binary.Read(&signatures.Header)` reads 28 bytes, `buf` points to the start of the `SignatureHeaderSize` vendor bytes. Both entry loops start at `sigOffset := 0` instead of `sigOffset := SignatureHeaderSize`, causing vendor bytes to be read as signature entries.\n\n## Affected versions\n\nAll versions through commit `f877374` (2026-05-15).\n\n## Fix\n\nPull request: https://github.com/google/go-attestation/pull/502\n\n- Add bound check: `SignatureHeaderSize` must not exceed remaining list space\n- Skip `SignatureHeaderSize` bytes before both entry loops\n- Regression test: `TestParseEfiSignatureListNonZeroSignatureHeaderSize`","state":0,"publishedAt":"2026-06-12T15:04:43+00:00","modifiedAt":"2026-09-12T05:15:04.6939817+00:00","affected":[{"ecosystem":"Go","name":"github.com/google/go-attestation","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/google/go-attestation/security/advisories/GHSA-9r4w-jg96-92mv","https://nvd.nist.gov/vuln/detail/CVE-2026-12681","https://github.com/google/go-attestation/pull/502","https://github.com/google/go-attestation/commit/b6e905e7ae52937f02b5ca494dd1c6a3ac7a1003","https://github.com/google/go-attestation","https://github.com/google/go-attestation/releases/tag/v0.6.1"],"sourceUrl":"https://github.com/advisories/GHSA-9r4w-jg96-92mv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9r4w-jg96-92mv","identifiers":["GHSA-9r4w-jg96-92mv","CVE-2026-12681","GO-2026-5298"]},"retained":false,"historicalAffected":[]}],"coverage":[]}