LF-Edge EVE OS up to 9.4.x PCR14 sensitive information

Summaryinfo

A vulnerability has been found in LF-Edge EVE OS up to 9.4.x and classified as critical. Impacted is an unknown function of the component PCR14 Handler. The manipulation leads to sensitive information. This vulnerability is uniquely identified as CVE-2023-43630. Local access is required to approach this attack. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in LF-Edge EVE OS up to 9.4.x. It has been rated as critical. This issue affects an unknown part of the component PCR14 Handler. The manipulation with an unknown input leads to a sensitive information vulnerability. Using CWE to declare the problem leads to CWE-922. The product stores sensitive information without properly limiting read or write access by unauthorized actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”

The weakness was disclosed 09/20/2023. It is possible to read the advisory at asrg.io. The identification of this vulnerability is CVE-2023-43630. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 9.5.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• LF-Edge

Name

• EVE OS

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion