Threats tagged 'ghsa-v88g-2xfr-q7qq'

The CCC Attestation SIG attested-tls-poc project contains a time-of-check time-of-use (TOCTOU) vulnerability in its attestation process. The vulnerability arises because evidence is only appraised once during the TLS handshake, with no re-attestation after the handshake completes. This allows attackers with local access to the attesting endpoint to modify workload code, data, configuration, or attached devices such as GPUs, while peers continue to trust the original attestation evidence.