Skip to content

User data in TPM attestation vulnerable to MITM

High severity GitHub Reviewed Published Feb 17, 2023 in edgelesssys/constellation

Package

gomod github.com/edgelesssys/constellation/v2 (Go)

Affected versions

<= 2.5.1

Patched versions

2.5.2

Description

Impact

Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

Patches

The issue has been patched in v2.5.2.

Workarounds

none

References

@derpsteb derpsteb published to edgelesssys/constellation Feb 17, 2023
Published to the GitHub Advisory Database Feb 17, 2023
Reviewed Feb 17, 2023

Severity

High

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-r2h5-3hgw-8j34
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.