Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

nitro-tpm-pcr-compute

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0crates.ioPublished

    nitro-tpm-pcr-compute may allow kernel command line modification by an account operator

    GHSA-xrv8-2pf5-f3q7

    Affected
    • crates.io nitro-tpm-pcr-compute < 1.1.0
    Fixed in
    1.1.0· Vendor fix available
    Issue
    Adding default PCR12 validation to ensure that account operators can not modify kernel command line parameters, potentially bypassing root filesystem integrity validation. Attestable AMIs are based on the systemd Unified Kernel Image (UKI) concept which uses systemd-boot to create a single measured UEFI binary from a Linux kernel, its initramfs, and kernel command line. The embedded kernel command line contains a dm-verity hash value that establishes trust in the root file system. When UEFI Secure Boot is disabled, systemd-boot appends any command line it receives to the kernel command line. Account operators with the ability to modify UefiData can install a boot variable with a command line that deactivates root file system integrity validation, while preserving the original PCR4 value. Systemd-boot provides separate measurement of command line modifications in PCR12. Impact In line with the TPM 2.0 specification and systemd-stub logic, KMS policies that do not include…

    Recommended action: Upgrade to 1.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →