LF-Edge EVE OS up to 8.5.x/9.5.x Pillar Eve Container /config/authorized_keys insufficiently protected credentials

Summaryinfo

A vulnerability classified as critical was found in LF-Edge EVE OS up to 8.5.x/9.5.x. This impacts an unknown function of the file /config/authorized_keys of the component Pillar Eve Container. Such manipulation leads to insufficiently protected credentials. This vulnerability is listed as CVE-2023-43631. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in LF-Edge EVE OS up to 8.5.x/9.5.x. It has been rated as critical. Affected by this issue is an unknown function of the file /config/authorized_keys of the component Pillar Eve Container. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. Using CWE to declare the problem leads to CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Impacted is confidentiality, integrity, and availability. CVE summarizes:

On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized keys for root login. An attacker could easily add their own keys and gain full control over the system without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable, and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thus not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13: • aa3501d6c57206ced222c33aea15a9169d629141 • 5fef4d92e75838cc78010edaed5247dfbdae1889. This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.

The weakness was presented 09/21/2023. The advisory is shared for download at asrg.io. This vulnerability is handled as CVE-2023-43631 since 09/20/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading to version 8.6.0 or 9.5.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• LF-Edge

Name

• EVE OS

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion