Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-43635— Vault Key Sealed With SHA1 PCRs

Quick assessment

Affected
LF-Edge, Zededa EVE OS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

EVE OS是IF Edge开源的一个用于分布式边缘计算的通用、开放的基于 Linux 的操作系统。 EVE OS存在安全漏洞，该漏洞源于使用了不安全的SHA1 PCR算法来密封保险库密钥，导致解封密钥复杂度降低。

CVSS 8.8 · High EPSS 0.11% · P1
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-43635

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vault Key Sealed With SHA1 PCRs
Source: CVE Program / CVE List V5
Vulnerability Description
Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry. These PCRs are then used in order to seal/unseal a key from the TPM which is used to encrypt/decrypt the “vault” directory. This “vault” directory is the most sensitive point in the system and as such, its content should be protected. This mechanism is noted in Zededa’s documentation as the “measured boot” mechanism, designed to protect said “vault”. The code that’s responsible for generating and fetching the key from the TPM assumes that SHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being checked. The issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs. This leads to several issues: • Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well as not sealing their keys at all, meaning the “vault” is not protected from an attacker. • SHA1 is considered insecure and reduces the complexity level required to unseal the key in machines which have their SHA1 PCRs enabled. An attacker can very easily retrieve the contents of the “vault”, which will effectively render the “measured boot” mechanism meaningless.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
EVE OS 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
EVE OS是IF Edge开源的一个用于分布式边缘计算的通用、开放的基于 Linux 的操作系统。 EVE OS存在安全漏洞，该漏洞源于使用了不安全的SHA1 PCR算法来密封保险库密钥，导致解封密钥复杂度降低。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
LF-Edge, Zededa EVE OS 0 ~ 9.5.0 -

II. Public POCs for CVE-2023-43635

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-43635

请登录查看更多情报信息。

Other References for CVE-2023-43635 (1)

Same Patch Batch · LF-Edge, Zededa · 2023-09-20 · 3 CVEs total

CVE-2023-43636 8.8 HIGH Rootfs Not Protected
CVE-2023-43630 8.8 HIGH Config Partition Not Measured From 2 Fronts

IV. Related Vulnerabilities

Same product: EVE OS
Same vendor: LF-Edge, Zededa
Same weakness: CWE-522

V. Comments for CVE-2023-43635

No comments yet

Leave a comment