Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1283: Mutable Attestation or Measurement Reporting Data

Base Incomplete

The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Measurement data should be stored in registers that are read-only or otherwise have access controls that prevent modification by an untrusted agent.

Source: MITRE CWE-1283

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-29038

    tpm2 does not detect if quote was not generated by TPM

    tpm2-tools is the source repository for the Trusted Platform Module (TPM2.0) tools. A malicious attacker can generate arbitrary quote data which is not detected by `tpm2 checkquote`. This issue was patched in version 5.7.

    tpm2-software tpm2-tools tpm2-tools tpm2-tools Debian Ubuntu Alpine
  • Medium 4.6
    CVE-2022-1740

    2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283

    The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malic…

    Dominion Voting Systems ImageCast X firmware ImageCast X application