Config Partition Not Measured From 2 Fronts
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.
Summary
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LF-Edge, Zededa | EVE OS | 9.0.0 to before 9.5.0 | 9.5.0 | Patch available | CNA |
| — | github.com/lf-edge/eve (Go) | before 0.0.0-20230126065759-d9383a7ee4e1 | 0.0.0-20230126065759-d9383a7ee4e1 | Patch available | GHSA-phcg-h58r-gmcq |
- EVE OS VendorLF-Edge, Zededa Affected 9.0.0 to before 9.5.0 Fixed in 9.5.0 Patch available CNA
- github.com/lf-edge/eve (Go) Vendor— Affected before 0.0.0-20230126065759-d9383a7ee4e1 Fixed in 0.0.0-20230126065759-d9383a7ee4e1 Patch available GHSA-phcg-h58r-gmcq
Remediation
- Fix · CNA EVE OS ( LF-Edge, Zededa) Fixed in 9.5.0
- Fix · GHSA-phcg-h58r-gmcq github.com/lf-edge/eve (Go) Fixed in 0.0.0-20230126065759-d9383a7ee4e1 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
LF-Edge, Zededa EVE OS 9.5.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-23363 Insufficiently protected credentials in LF-Edge, Zededa EVE OSPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2023-43630
- 2026-10-03 Alias added: GHSA-phcg-h58r-gmcq
References
Other 7
- https://asrg.io/security-advisories/cve-2023-43630/
- https://github.com/lf-edge/eve/security/advisories/GHSA-phcg-h58r-gmcq
- https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a
- https://asrg.io/security-advisories/config-partition-not-measured-from-2-fronts
- https://asrg.io/security-advisories/cve-2023-43630
- https://github.com/lf-edge/eve
- https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications
More LF-Edge, Zededa vulnerabilities
- TI-2025-34188 eKuiper API endpoints handling SQL queries with user-controlled table names. CVSS 4.0HIGH 8.9
- TI-2024-29055 LF Edge eKuiper has a SQL Injection in sqlKvStore CVSS 3.1HIGH 8.8
- TI-2024-34965 Stored XSS in Configuration Key Functionality CVSS 3.1MEDIUM 6.3
- TI-2024-35324 LF Edge eKuiper has Stored XSS in Rules Functionality CVSS 3.1MEDIUM 5.4
- TI-2023-23360 Freely Allocate Buffer on The Stack With Data From Socket CVSS 3.1CRITICAL 9.9
- TI-2023-23364 Rootfs Not Protected CVSS 3.1HIGH 8.8
Sources
- CVE-2023-43630 · CVE Program
- CVE-2023-43630 · NVD
- FIRST EPSS
- GHSA-phcg-h58r-gmcq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences