Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-43632— Freely Allocate Buffer on The Stack With Data From Socket

Quick assessment

Affected
LF-Edge, Zededa EVE OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EVE OS是IF Edge开源的一个用于分布式边缘计算的通用、开放的基于 Linux 的操作系统。 EVE OS存在安全漏洞，该漏洞源于允许攻击者使用来自套接字的数据在堆栈上自由分配缓冲区，从而导致系统崩溃。

CVSS 9.0 · Critical EPSS 0.66% · P51
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-43632

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Freely Allocate Buffer on The Stack With Data From Socket
Source: CVE Program / CVE List V5
Vulnerability Description
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communication with this server is done using protobuf, and the data is comprised of 2 parts: 1. Header 2. Data When a connection is made, the server is waiting for 4 bytes of data, which will be the header, and these 4 bytes would be parsed as uint32 size of the actual data to come. Then, in the function “handleRequest” this size is then used in order to allocate a payload on the stack for the incoming data. As this payload is allocated on the stack, this will allow overflowing the stack size allocated for the relevant process with freely controlled data. * An attacker can crash the system. * An attacker can gain control over the system, specifically on the “vtpm_server” process which has very high privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Vulnerability Title
EVE OS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
EVE OS是IF Edge开源的一个用于分布式边缘计算的通用、开放的基于 Linux 的操作系统。 EVE OS存在安全漏洞，该漏洞源于允许攻击者使用来自套接字的数据在堆栈上自由分配缓冲区，从而导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
LF-Edge, Zededa EVE OS 3.0.0 ~ 9.5.0 -

II. Public POCs for CVE-2023-43632

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-43632

请登录查看更多情报信息。

Other References for CVE-2023-43632 (1)

Same Patch Batch · LF-Edge, Zededa · 2023-09-21 · 5 CVEs total

CVE-2023-43634 8.8 HIGH Config Partition Not Protected by Measured Boot
CVE-2023-43633 8.8 HIGH Debug Functions Unlockable Without Triggering Measured Boot
CVE-2023-43631 8.8 HIGH SSH as Root Unlockable Without Triggering Measured Boot
CVE-2023-43637 7.8 HIGH Vault Key Partially Predetermined

IV. Related Vulnerabilities

Same product: EVE OS
Same vendor: LF-Edge, Zededa
Same weakness: CWE-789