GHSA-r2h5-3hgw-8j34 User data in TPM attestation vulnerable to MITM

Not scored Published 17 Feb 2023

A privileged insider can bypass TPM attestation checks to join a malicious node to a Constellation cluster, compromising cluster integrity.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-r2h5-3hgw-8j34?

GHSA-r2h5-3hgw-8j34 is a vulnerability in github.com/edgelesssys/constellation, published on 17 Feb 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Impact

Attestation user data (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

Patches

The issue has been patched in v2.5.2.

Workarounds

none

Which versions are affected by GHSA-r2h5-3hgw-8j34?

4 open source packages ship an affected version, including github.com/edgelesssys/constellation/v2 and github.com/edgelesssys/constellation.

Package	Affected	Fixed in
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.5.2`
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.5.2`
`github.com/edgelesssys/constellation/v2` Go	All versions	`2.5.2`
`github.com/edgelesssys/constellation` Go	All versions	None

How do I fix GHSA-r2h5-3hgw-8j34?

Upgrade github.com/edgelesssys/constellation/v2 to 2.5.2 or later.

Is GHSA-r2h5-3hgw-8j34 being exploited?

There is no known exploitation of GHSA-r2h5-3hgw-8j34 in the wild and no public exploit code.

Sources

Also known as GO-2023-1583.