Vulnerability Report: GO-2021-0095
- CVE-2020-8918, GHSA-5x29-3hr9-6wpw
- Affects: github.com/google/go-tpm
- Published: Apr 14, 2021
- Modified: May 20, 2024
Due to repeated usage of a XOR key an attacker that can eavesdrop on the TPM 1.2 transport is able to calculate usageAuth for keys created using CreateWrapKey, despite it being encrypted, allowing them to use the created key.
Affected Packages
-
PathVersionsSymbols
-
before v0.3.0
Aliases
References
- https://github.com/google/go-tpm/pull/195
- https://github.com/google/go-tpm/commit/d7806cce857a1a020190c03348e5361725d8f141
- https://vuln.go.dev/ID/GO-2021-0095.json
Credits
- Chris Fenner
Feedback
See anything missing or incorrect?
Suggest an edit to this report.