Go FIDO/U2F Security Key User Presence Bypass Vulnerability

A vulnerability exists in the Verify() method for FIDO/U2F security key types, specifically sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com. The issue arises because the method did not verify the User Presence flag, allowing signatures to be generated without physical interaction. This oversight enabled the unattended use of hardware security keys. The vulnerability affects Go versions prior to 0.52.0.

Impact

Exploitation of this vulnerability allows for the unattended use of hardware security keys, bypassing the required physical interaction.

Remediation

Users can update to Go version 0.52.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version of Go are available on the official Go website.