Contribution: EarlyAttestationTschüss (EAT): 8+ Critical-Severity Vulnerabilities of CVSS 9.1 in Early Attestation Exposed by Formal Analysis in ProVerif

Contribution: EarlyAttestationTschüss (EAT): 8+ Critical-Severity Vulnerabilities of CVSS 9.1 in Early Attestation Exposed by Formal Analysis in ProVerif

[Muhammad Usama Sardar]

[-- Attachment #1: Type: text/plain, Size: 1803 bytes --]

Hi all,

Following up on our previous contribution, GitHub has completed its 
review of the 7 GitHub Security Advisories (GHSAs) on relay and 
diversion attacks we reported against early attestation implementations 
of Privasys and Edgeless Systems based on our formal analysis in 
ProVerif. GitHub has issued 7 new CVEs [0-6], each with CVSS severity 
score of 9.1 out of 10 for each.

Another CNA VulnCheck has reviewed and accepted our vulnerability report 
against early attestation implementation of Confidential Computing 
Consortium (CCC) Attestation Special Interest Group (SIG) and issued one 
new CVE [7] with CVSS severity score of 9.1.

NIST and ENISA have correspondingly added those CVEs in their NVD and 
EUVD, respectively.

This provides increasingly more evidence that early attestation [8] is 
harmful. Privasys has already moved to our proposed post-handshake 
attestation proposal [9]. CCC Attestation SIG has archived their repo of 
early attestation. Edgeless Systems still maintains an early attestation 
implementation. Further details are in [10].

Best regards,
-Usama and Songbo


[0] https://www.cve.org/CVERecord?id=CVE-2026-108265

[1] https://www.cve.org/CVERecord?id=CVE-2026-108266

[2] https://www.cve.org/CVERecord?id=CVE-2026-108267

[3] https://www.cve.org/CVERecord?id=CVE-2026-108268

[4] https://www.cve.org/CVERecord?id=CVE-2026-108269

[5] https://www.cve.org/CVERecord?id=CVE-2026-108362

[6] https://www.cve.org/CVERecord?id=CVE-2026-100835

[7] https://www.cve.org/CVERecord?id=CVE-2026-112377

[8] https://datatracker.ietf.org/doc/draft-fossati-seat-early-attestation/

[9] https://datatracker.ietf.org/doc/draft-fossati-seat-expat/

[10] https://www.ietf.org/archive/id/draft-intra-handshake-fail-55.html


[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4854 bytes --]

Re: [cip-dev] Contribution: EarlyAttestationTschüss (EAT): 8+ Critical-Severity Vulnerabilities of CVSS 9.1 in Early Attestation Exposed by Formal Analysis in ProVerif

[Pavel Machek]

[-- Attachment #1: Type: text/plain, Size: 327 bytes --]

Hi!

> Following up on our previous contribution, GitHub has completed its review
> of the 7 GitHub Security Advisories (GHSAs) on relay and diversion attacks
> we reported against early attestation implementations of Privasys
> and

Can you briefly explain link between your work and CIP project?

Best regards,
								Pavel

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]