CVE-2025-64186
📋 TL;DR
The evervault-go SDK's attestation verification logic had a vulnerability where incomplete enclave attestation documents could pass validation, potentially allowing clients to trust enclave operators that don't meet expected integrity guarantees. This primarily affects applications using evervault-go to attest enclaves hosted outside Evervault environments. The vulnerability is most severe for applications that only check PCR8 values.
💻 Affected Systems
- evervault-go SDK
📦 What is this software?
Evervault by Evervault
⚠️ Risk & Real-World Impact
Worst Case
Attackers could impersonate trusted enclaves, potentially compromising sensitive payment data or other protected information processed by vulnerable enclaves.
Likely Case
Limited impact in Evervault-hosted environments due to prerequisite requirements; higher risk for custom deployments with incomplete PCR checking.
If Mitigated
Minimal impact if applications check PCR 0, 1, and 2 values or upgrade to patched version.
🎯 Exploit Status
Exploitation requires ability to serve requests from specific evervault domain names and target applications with incomplete PCR checking.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2
Vendor Advisory: https://github.com/evervault/evervault-go/security/advisories/GHSA-88h9-77c7-p6w4
Restart Required: Yes
Instructions:
1. Update evervault-go dependency to version 1.3.2 or later. 2. Rebuild and redeploy affected applications. 3. Restart services using the updated SDK.
🔧 Temporary Workarounds
Enhanced PCR validation
allModify application logic to fail verification if PCR8 is not explicitly present and non-empty
Modify attestation verification code to explicitly check PCR8 presence and content
Custom pre-validation
allAdd custom validation to reject attestation documents that omit any required PCRs
Implement additional validation layer before main attestation verification
🧯 If You Can't Patch
- Implement workarounds to enhance PCR validation in application code
- Ensure applications check PCR 0, 1, and 2 values in addition to PCR8
🔍 How to Verify
Check if Vulnerable:
Check if evervault-go version is below 1.3.2 in go.mod or vendor dependenciesCheck Version:
grep 'evervault-go' go.mod | grep -E 'v[0-9]+\.[0-9]+\.[0-9]+'Verify Fix Applied:
Confirm evervault-go version is 1.3.2 or higher and verify attestation documents are properly validated📡 Detection & Monitoring
Log Indicators:
- Failed attestation attempts with incomplete PCR data
- Unusual enclave verification patterns
Network Indicators:
- Attestation requests to non-standard enclave endpoints
- Unusual TLS certificate patterns
SIEM Query:
source="application_logs" AND ("attestation" OR "PCR") AND ("failed" OR "incomplete" OR "validation")🔗 References
- https://github.com/evervault/evervault-go/commit/7c824d289bba11ec0bea46a338023f5b128bbb28
- https://github.com/evervault/evervault-go/pull/48
- https://github.com/evervault/evervault-go/security/advisories/GHSA-88h9-77c7-p6w4
- https://github.com/evervault/evervault-go/security/advisories/GHSA-88h9-77c7-p6w4
