5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-43631

CVE-2023-43631: EVE: SSH as Root Unlockable Without Triggering Measured Boot

Impact

On boot, the Pillar container checks for /config/authorized_keys. If present with a valid public key, it enables SSH on port 22 with root login. The /config partition is not protected by measured boot, is mutable and unencrypted.

This enables an attacker with physical access to the device to take out the disk, modify the /config partition using a separate server, then insert it, without the inserted key being flagged as an integrity voilation my measured boot and remote attestation.

Patches

Patched in 9.4.3-lts

Workarounds

None (apart from preventing physical access to the device)

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-43631

CVE-2023-43631:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lf-edge/eve	go	< 0.0.0-20220708121648-5fef4d92e758	0.0.0-20220708121648-5fef4d92e758

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2023-43631, stems from a missing integrity check of the /config partition in the EVE OS boot process. An attacker with physical access could modify this partition to add their SSH public key, gaining root access because the change was not detected by the measured boot process.

The analysis of the patches reveals a two-part fix. The first part, in commit 5fef4d92e75838cc78010edaed5247dfbdae1889, introduces a new measurefs command to GRUB and modifies the boot script pkg/grub/rootfs.cfg. Specifically, the set_config_overrides function is updated to measure the /config partition into TPM PCR 13. This function is a critical part of the vulnerable process, as its prior version lacked this essential integrity check.

The second part of the fix, in commit aa3501d6c57206ced222c33aea15a9169d629141, updates the pillar application's TPM configuration. The DiskKeySealingPCRs variable in pkg/pillar/evetpm/tpm.go is modified to include PCR 13. This ensures that the disk encryption key is sealed against the measurement of the /config partition. Any function using this variable to unseal the key would now fail if the /config partition has been tampered with, preventing the system from booting and the SSH key from being used.

While the Go function that reads the malicious authorized_keys file is not directly visible in the patches, the set_config_overrides GRUB function is explicitly shown and is the point where the lack of integrity measurement occurs in the boot chain. Therefore, it is identified as a key function in the vulnerability.

Vulnerable functions

set_config_overrides

pkg/grub/rootfs.cfg

This GRUB boot script function handles the configuration overrides from the CONFIG partition. In the vulnerable version, it did not measure the integrity of this partition. An attacker could modify the partition to inject a malicious SSH key, and this function would proceed to use it without detecting the tampering. The patch adds a call to `measurefs` to measure the partition into PCR 13, thus fixing the vulnerability at the bootloader level.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.9

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-43631: EVE: SSH as Root Unlockable Without Triggering Measured Boot

Impact

Patches

Workarounds

CVE-2023-43631:

5.9

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2023-43631: EVE: SSH as Root Unlockable Without Triggering Measured Boot

Impact

Patches

Workarounds

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

5.9

5.9

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI