Read the docs
TI-2023-23360 Aliases CVE-2023-43632GHSA-6jp5-grgh-jw42

Freely Allocate Buffer on The Stack With Data From Socket

Priority MEDIUM 44CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communication with this server is done using protobuf, and the data is comprised of 2 parts: 1. Header 2. Data When a connection is made, the server is waiting for 4 bytes of data, which will be the header, and these 4 bytes would be parsed as uint32 size of the actual data to come. Then, in the function “handleRequest” this size is then used in order to allocate a payload on the stack for the incoming data. As this payload is allocated on the stack, this will allow overflowing the stack size allocated for the relevant process with freely controlled data. * An attacker can crash the system. * An attacker can gain control over the system, specifically on the “vtpm_server” process which has very high privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00658 51st percentileScored 2026-11-07
Fix Fixed EVE OS ( LF-Edge, Zededa): 9.5.0github.com/lf-edge/eve (Go): 0.0.0-20230519072751-977f42b07fa9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LF-Edge, ZededaEVE OS3.0.0 to before 9.5.09.5.0Patch availableCNA
—github.com/lf-edge/eve (Go)before 0.0.0-20230519072751-977f42b07fa90.0.0-20230519072751-977f42b07fa9Patch availableGHSA-6jp5-grgh-jw42
  • EVE OS VendorLF-Edge, Zededa Affected 3.0.0 to before 9.5.0 Fixed in 9.5.0 Patch available CNA
  • github.com/lf-edge/eve (Go) Vendor— Affected before 0.0.0-20230519072751-977f42b07fa9 Fixed in 0.0.0-20230519072751-977f42b07fa9 Patch available GHSA-6jp5-grgh-jw42

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:*3.0.0 to before 9.5.0Vulnerablebackstage
  • cpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:* Versions 3.0.0 to before 9.5.0 Vulnerable ·backstage

Remediation

  • Fix · CNA EVE OS ( LF-Edge, Zededa) Fixed in 9.5.0
  • Fix · GHSA-6jp5-grgh-jw42 github.com/lf-edge/eve (Go) Fixed in 0.0.0-20230519072751-977f42b07fa9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43632
  2. 2026-10-03 Alias added: GHSA-6jp5-grgh-jw42
  3. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 5

  • TI-2025-34188 eKuiper API endpoints handling SQL queries with user-controlled table names. CVSS 4.0HIGH 8.9
  • TI-2024-29055 LF Edge eKuiper has a SQL Injection in sqlKvStore CVSS 3.1HIGH 8.8
  • TI-2024-34965 Stored XSS in Configuration Key Functionality CVSS 3.1MEDIUM 6.3
  • TI-2024-35324 LF Edge eKuiper has Stored XSS in Rules Functionality CVSS 3.1MEDIUM 5.4
  • TI-2023-23364 Rootfs Not Protected CVSS 3.1HIGH 8.8
  • TI-2023-23363 Insufficiently protected credentials in LF-Edge, Zededa EVE OS CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences