SSH as Root Unlockable Without Triggering Measured Boot
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.
Summary
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized keys for root login. An attacker could easily add their own keys and gain full control over the system without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable, and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thus not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13: • aa3501d6c57206ced222c33aea15a9169d629141 • 5fef4d92e75838cc78010edaed5247dfbdae1889. This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| LF-Edge, Zededa | EVE OS | before 8.6.0; 9.0.0 to before 9.5.0 | 8.6.0, 9.5.0 | Patch available | CNA |
| — | github.com/lf-edge/eve (Go) | before 0.0.0-20220708121648-5fef4d92e758 | 0.0.0-20220708121648-5fef4d92e758 | Patch available | GHSA-3mq9-xhgq-r7gj |
- EVE OS VendorLF-Edge, Zededa Affected before 8.6.0; 9.0.0 to before 9.5.0 Fixed in 8.6.0, 9.5.0 Patch available CNA
- github.com/lf-edge/eve (Go) Vendor— Affected before 0.0.0-20220708121648-5fef4d92e758 Fixed in 0.0.0-20220708121648-5fef4d92e758 Patch available GHSA-3mq9-xhgq-r7gj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:* | before 8.6.0; 9.0.0 to before 9.5.0 | Vulnerable | backstage |
- cpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:* Versions before 8.6.0; 9.0.0 to before 9.5.0 Vulnerable ·backstage
Remediation
- Fix · CNA EVE OS ( LF-Edge, Zededa) Fixed in 8.6.0, 9.5.0
- Fix · GHSA-3mq9-xhgq-r7gj github.com/lf-edge/eve (Go) Fixed in 0.0.0-20220708121648-5fef4d92e758 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
LF-Edge, Zededa EVE OS 8.6.0, 9.5.0
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2023-23362 Config Partition Not Protected by Measured BootPriority LOW 39
- TI-2023-23361 Debug Functions Unlockable Without Triggering Measured BootPriority LOW 39
Timeline
- 2026-10-02 Threatist record created from CVE-2023-43631
- 2026-10-03 Alias added: GHSA-3mq9-xhgq-r7gj
References
Other 7
- https://asrg.io/security-advisories/cve-2023-43631/
- https://github.com/lf-edge/eve/security/advisories/GHSA-3mq9-xhgq-r7gj
- https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889
- https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141
- https://asrg.io/security-advisories/cve-2023-43631
- https://asrg.io/security-advisories/ssh-as-root-unlockable-without-triggering-measured-boot
- https://github.com/lf-edge/eve
More LF-Edge, Zededa vulnerabilities
- TI-2025-34188 eKuiper API endpoints handling SQL queries with user-controlled table names. CVSS 4.0HIGH 8.9
- TI-2024-29055 LF Edge eKuiper has a SQL Injection in sqlKvStore CVSS 3.1HIGH 8.8
- TI-2024-34965 Stored XSS in Configuration Key Functionality CVSS 3.1MEDIUM 6.3
- TI-2024-35324 LF Edge eKuiper has Stored XSS in Rules Functionality CVSS 3.1MEDIUM 5.4
- TI-2023-23360 Freely Allocate Buffer on The Stack With Data From Socket CVSS 3.1CRITICAL 9.9
- TI-2023-23364 Rootfs Not Protected CVSS 3.1HIGH 8.8
Sources
- CVE-2023-43631 · CVE Program
- CVE-2023-43631 · NVD
- FIRST EPSS
- GHSA-3mq9-xhgq-r7gj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences