6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-43637

CVE-2023-43637: EVE Has Partially Predetermined Vault Key

Impact

The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key.

Patches

Fixed in 7.10 and 8.12.1-lts

Workarounds

None

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-43637

CVE-2023-43637:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/lf-edge/eve	go	< 0.0.0-20220310190112-c0c966dc31e2	0.0.0-20220310190112-c0c966dc31e2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the vault key derivation process uses a hardcoded, predictable key. The function retrieveCloudKey in pkg/pillar/cmd/vaultmgr/vaultmgr.go provides a static 32-byte string. The deriveVaultKey function takes this key, along with a key generated by the TPM, and passes them to the mergeKeys function. mergeKeys then creates a new key by taking the first 16 bytes from the TPM key and the last 16 bytes from the hardcoded key. This means the final vault key always ends with the same predictable 16 bytes ('arfoobarfoobarfo'), significantly reducing its entropy and making it susceptible to a brute-force attack by an adversary with physical access to the device. The patch mitigates this by introducing a TpmKeyOnly mode that, when enabled, skips the flawed merging process and uses the full, random TPM key as the vault key.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.