CVE-2023-43630: high-severity vulnerability in LF-Edge, Zededa EVE OS
Config Partition Not Measured From 2 Fronts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.1%
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but
due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the
problem of the config partition not being measured correctly.
Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of
SHA256.
This issue was somewhat mitigated due to all of the PCR extend functions
updating both the values of SHA256 and SHA1 for a given PCR ID.
However, due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as
the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which
means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault”
key, changes to the config partition would still not be measured.
An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault”
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
LF-Edge, Zededa · EVE OSRelated CVEs — LF-Edge, Zededa EVE OS
In the same product, most dangerous first.
CVE-2023-43632CRITICALFreely Allocate Buffer on The Stack With Data From SocketEPSS 0.7%CVE-2023-43634HIGH Config Partition Not Protected by Measured BootEPSS 0.2%CVE-2023-43631HIGHSSH as Root Unlockable Without Triggering Measured BootEPSS 0.2%CVE-2023-43633HIGHDebug Functions Unlockable Without Triggering Measured BootEPSS 0.2%CVE-2023-43637HIGHVault Key Partially PredeterminedEPSS 0.1%CVE-2023-43636HIGHRootfs Not ProtectedEPSS 0.1%