Executive brief
Google go-attestation is a library used to verify the integrity of computer systems by validating cryptographic measurements and event logs during system boot. A flaw in how it parses Windows event logs allows an attacker to submit a specially crafted log file that triggers an uncontrolled recursive function call, exhausting available memory and crashing the verification application. This can disrupt system attestation checks and prevent proper security validation.
Technical details
The vulnerability is an uncontrolled recursion flaw in the Windows SIPA event log parser, specifically in the readELAMAggregation function of go-attestation versions up to 0.6.1. The function recurses for each nested elamAggregation sub-event without enforcing a maximum recursion depth limit, and the size guard is bypassed on recursive execution paths. An attacker can craft a Windows event log with deeply nested elamAggregation headers to exhaust the goroutine call stack, triggering a fatal stack overflow that crashes the verifier application. The fix, included in version 0.6.2, adds a recursion depth limit (maxELAMRecursionDepth = 8) and corrects the LimitedReader size check to prevent stack exhaustion attacks.
Affected products
- Google go-attestation up to and including 0.6.1
Timeline
- 2026-09-09: disclosed
- 2026-08-07: patched: Version 0.6.2 released with fix