CVE-2023-43637: Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be…

PriorityP340high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.13%

3.3th percentile

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys"). This makes the key a lot weaker. This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue. Roll an update that enforces the full 32bytes key usage.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
github.com	lf-edge_eve	>= 0 < 0.0.0-20220310190112-c0c966dc31e2	0.0.0-20220310190112-c0c966dc31e2
lf-edge_zededa	eve_os	< 7.10	7.10
lfedge	eve	< 7.10	7.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.