CVE-2023-43634: When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration…

PriorityP346high8.8CVSS 3.1

AVLACLPRLUINSCCHIHAH

EPSS

0.16%

5.6th percentile

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. In that process, PCR 13 was added to the list of PCRs that seal/unseal the key. In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of PCRs that seal/unseal the key. This change makes the measurement of PCR 14 effectively redundant as it would not affect the sealing/unsealing of the key. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”

Affected

5 ranges

Vendor	Product	Version range	Fixed in
github.com	lf-edge_eve	>= 0 < 0.0.0-20230519072751-977f42b07fa9	0.0.0-20230519072751-977f42b07fa9
lf-edge_zededa	eve_os	< 8.6.0	8.6.0
lf-edge_zededa	eve_os	>= 9.0.0 < 9.5.0	9.5.0
lfedge	eve	< 8.6.0	8.6.0
lfedge	eve	>= 9.0.0 < 9.5.0	9.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.