5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-43630

CVE-2023-43630: EVE Doesn't Measure Config Partition From 2 Fronts

Impact

PCR14 is not included in the list of PCRs that seal/unseal the vault key. Additionally, the vault key uses SHA1 PCRs instead of SHA256. Thus an attacker with physical access can take out the disk, use a different computer to modify the files in the /config partition, and re-insert the disk and boot without the change being detected by measured boot and remote attestation.

Patches

Fixed in EVE version 9.4.3-lts

Workarounds

None (apart from preventing physical access to the device)

Resources

https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-43630

CVE-2023-43630:

5.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lf-edge/eve	go	< 0.0.0-20230126065759-d9383a7ee4e1	0.0.0-20230126065759-d9383a7ee4e1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2023-43630, lies in the improper configuration of the Trusted Platform Module (TPM) sealing mechanism for the vault key in EVE OS. The root cause is twofold: the use of the outdated SHA1 hashing algorithm and, more critically, the omission of PCR14 from the list of registers used to seal the key. PCR14 is responsible for measuring the integrity of the configuration partition (/config).

The provided patch d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a directly addresses this by modifying the global variable DiskKeySealingPCRs in pkg/pillar/evetpm/tpm.go. The patch switches the hash algorithm to SHA256 and adds PCR14 to the list of PCRs.

An attacker with physical access could exploit this by removing the disk, modifying files in the /config partition, and reinstalling it. During boot, the system would fail to detect these modifications because the integrity of that partition was not being measured as part of the unsealing policy. The functions identified as vulnerable are those that constitute the runtime execution path for sealing and unsealing the disk key, as they directly or indirectly consume this flawed configuration. When the system boots, FetchSealedVaultKey and subsequently UnsealDiskKey would appear in a profiler's stack trace, executing the flawed logic that permits unsealing the key despite the integrity violation.

Vulnerable functions

evetpm.FetchSealedVaultKey

pkg/pillar/evetpm/tpm.go

This function orchestrates the process of retrieving the vault key. It relies on other functions that use the vulnerable 'DiskKeySealingPCRs' variable, which was configured with a weak hash (SHA1) and an incomplete set of PCRs (missing PCR14). This makes the entire key fetching process vulnerable.

evetpm.SealDiskKey

pkg/pillar/evetpm/tpm.go

This function is responsible for sealing the disk key into the TPM. It uses a PCR selection that, prior to the patch, was based on the vulnerable 'DiskKeySealingPCRs' variable. This means new keys were sealed with inadequate protection (SHA1 and missing PCR14).

evetpm.UnsealDiskKey

pkg/pillar/evetpm/tpm.go

This function unseals the disk key from the TPM. During exploitation, this function would be called at boot time. Because it uses the flawed PCR configuration from 'DiskKeySealingPCRs', it would incorrectly validate the system state and unseal the key even if the configuration partition (measured by PCR14) has been tampered with.

evetpm.PolicyPCRSession

pkg/pillar/evetpm/tpm.go

This function creates the TPM authorization policy based on the provided PCR selection. It is called by both SealDiskKey and UnsealDiskKey. It directly consumes the vulnerable PCR configuration ('DiskKeySealingPCRs'), creating a flawed policy that doesn't properly protect the sealed key against unauthorized modifications of the config partition.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-43630: EVE Doesn't Measure Config Partition From 2 Fronts

Impact

Patches

Workarounds

Resources

CVE-2023-43630:

5.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2023-43630: EVE Doesn't Measure Config Partition From 2 Fronts

Impact

Patches

Workarounds

Resources

Basic Information

Basic Information

5.2

5.2

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI