CVE-2024-47534: go-tuf Delegation Tracing Vulnerability

CVE-2024-47534 Overview

CVE-2024-47534 affects go-tuf, the Go implementation of The Update Framework (TUF). The client inconsistently traces delegations when resolving target metadata. When targets delegates to roles A and B, and B further delegates to C, the client may trace delegations in the wrong order such as B->C->A instead of the expected A->B->C. This breaks the security guarantees TUF provides around delegated trust and target resolution. The issue is tracked as [CWE-362] race condition / ordering and is fixed in go-tuf version 2.0.1.

Critical Impact
Incorrect delegation ordering can cause clients to resolve targets through the wrong delegated role, undermining the integrity guarantees of the TUF update mechanism.

Affected Products

go-tuf (The Update Framework Go implementation) prior to 2.0.1
Software supply chain tools depending on go-tuf for secure update delivery
Sigstore and related components that consume go-tuf as a dependency

Discovery Timeline

2024-10-01 - CVE-2024-47534 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47534

Vulnerability Analysis

The vulnerability resides in the GetRolesForTarget function in metadata/metadata.go. The function was responsible for returning all delegated roles that handle a given targetFilepath. The original implementation returned results in a Go map[string]bool, where iteration order is not deterministic. TUF requires delegations to be traced in the exact order they appear in the role's delegation list, with terminating delegations halting further traversal. Returning results in a map destroyed that ordering. A client could therefore evaluate delegations in an arbitrary sequence and accept a target signed by a role that should not have been consulted first.

Root Cause

The root cause is the use of an unordered data structure to convey ordered metadata. The TUF specification mandates a pre-image preserving traversal of the delegation graph. Map iteration in Go randomizes order at runtime, producing nondeterministic and incorrect delegation traversal across executions.

Attack Vector

A repository operator or attacker controlling a delegated role's metadata can leverage the ordering flaw. By crafting overlapping delegations where one role should be evaluated before another, the attacker can cause clients to retrieve and trust target files from an unintended delegated role. The vulnerability is reachable over the network without privileges or user interaction, which aligns with the integrity-focused impact.

// Security patch in metadata/metadata.go - converts unordered map to ordered slice
// Source: https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819

// GetRolesForTarget return the names and terminating status of all
// delegated roles who are responsible for targetFilepath
// Note the result should be an ordered list, ref. GHSA-4f8r-qqr9-fq8j
func (role *Delegations) GetRolesForTarget(targetFilepath string) []RoleResult {
    var res []RoleResult
    // Standard delegations
    if role.Roles != nil {
        for _, r := range role.Roles {
            ok, err := r.IsDelegatedPath(targetFilepath)
            if err == nil && ok {
                res = append(res, RoleResult{Name: r.Name, Terminating: r.Terminating})
            }
        }
    } else if role.SuccinctRoles != nil {
        // SuccinctRoles delegations
        res = role.SuccinctRoles.GetRolesForTarget(targetFilepath)
    }
    // We preserve the same order as the actual roles list
    return res
}

// RoleResult represents the name and terminating status of a delegated role
type RoleResult struct {
    Name        string
    Terminating bool
}

The new RoleResult slice preserves the declaration order of delegated roles. See the GitHub Security Advisory GHSA-4f8r-qqr9-fq8j for the full advisory.

Detection Methods for CVE-2024-47534

Indicators of Compromise

Unexpected target files served from a delegated role that should have been preempted by an earlier or terminating delegation.
Update transactions where the resolved signing role does not match the first matching delegation path declared in targets metadata.
Build pipelines pulling artifacts via go-tuf versions earlier than 2.0.1.

Detection Strategies

Inventory all Go binaries and services that import github.com/theupdateframework/go-tuf and identify versions below 2.0.1.
Audit TUF repository delegation chains and compare client-resolved target ownership against the expected ordered traversal.
Use software composition analysis to flag dependent modules including Sigstore tooling that transitively pull vulnerable go-tuf releases.

Monitoring Recommendations

Log the resolved delegated role for every TUF target lookup and alert when the role differs across clients for the same target.
Monitor outbound fetches to TUF repository mirrors and correlate target hashes with expected delegation owners.
Track go-tuf module versions referenced in go.mod files across CI/CD systems and gate builds on patched versions.

How to Mitigate CVE-2024-47534

Immediate Actions Required

Upgrade go-tuf to version 2.0.1 or later in all projects, including transitive dependencies.
Rebuild and redeploy any binaries embedding go-tuf, since the fix is a compiled-in library change.
Re-verify previously fetched targets against the expected ordered delegation chain to confirm no incorrect role resolutions occurred.

Patch Information

The fix is delivered in go-tuf 2.0.1. The relevant commits change GetRolesForTarget to return an ordered []RoleResult slice instead of a map[string]bool. Review the GitHub commit f36420ca and the supporting GitHub commit edc30b47 for the complete fix. Conformance test coverage was added in the tuf-conformance pull request 115.

Workarounds

If immediate upgrade is not possible, restrict TUF repositories to flat, non-nested delegation structures so that ordering ambiguity cannot be exploited.
Pin target ownership to a single top-level role and avoid multi-level delegation graphs until patched clients are deployed.
Validate fetched targets out-of-band against an authoritative manifest until go-tuf 2.0.1 is rolled out.

bash

# Update go-tuf to the patched version in your Go module
go get github.com/theupdateframework/go-tuf/v2@v2.0.1
go mod tidy

# Verify the resolved version
go list -m github.com/theupdateframework/go-tuf/v2