CVE-2023-43635 Vault Key Sealed With SHA1 PCRs
Attackers can bypass measured boot protections and read sensitive vault data because the TPM key is sealed with insecure SHA1 PCRs instead of SHA256.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-43635?
CVE-2023-43635 is a high-severity vulnerability in EVE OS, published on 20 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Vault Key Sealed With SHA1 PCRs
The measured boot solution implemented in EVE OS leans on a PCR locking mechanism.
Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry.
These PCRs are then used in order to seal/unseal a key from the TPM which is used to encrypt/decrypt the “vault” directory.
This “vault” directory is the most sensitive point in the system and as such, its content should be protected.
This mechanism is noted in Zededa’s documentation as the “measured boot” mechanism, designed to protect said “vault”.
The code that’s responsible for generating and fetching the key from the TPM assumes that SHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being checked.
The issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs. This leads to several issues:
• Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well as not sealing their keys at all, meaning the “vault” is not protected from an attacker.
• SHA1 is considered insecure and reduces the complexity level required to unseal the key in machines which have their SHA1 PCRs enabled.
An attacker can very easily retrieve the contents of the “vault”, which will effectively render the “measured boot” mechanism meaningless.
Which versions are affected by CVE-2023-43635?
3 open source packages ship an affected version, including github.com/lf-edge/eve. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lf-edge/eve Go | All versions | 0.0.0-20230519072751-977f42b07fa9 |
github.com/lf-edge/eve Go | All versions | 0.0.0-20230519072751-977f42b07fa9 |
github.com/lf-edge/eve Go | All versions | 0.0.0-20230519072751-977f42b07fa9 |
Products include Linuxfoundation Edge Virtualization Engine.
How do I fix CVE-2023-43635?
Upgrade github.com/lf-edge/eve to 0.0.0-20230519072751-977f42b07fa9 or later.
Is CVE-2023-43635 being exploited?
There is no known exploitation of CVE-2023-43635 in the wild and no public exploit code.
Other vulnerabilities in EVE OS
Sources
Also known as GHSA-4jvr-vj2c-8q37, GO-2026-4434.