Microsoft Azure Attestation and Device Health Attestation Service Spoofing Vulnerability

A spoofing vulnerability has been identified in the Microsoft Azure Attestation service and the Device Health Attestation Service. This issue arises from improper input validation, which allows an authorized attacker to perform spoofing through a physical attack.

Impact

Exploitation of this vulnerability could lead to unauthorized spoofing actions, potentially allowing attackers to manipulate or falsify information or identities within the affected services.

Remediation

Microsoft has already deployed a service-side fix for this vulnerability in Azure Attestation. No customer patching or update installation is required. For the Device Health Attestation Service, users should consult the Microsoft Update Catalog for available security updates.