CVE-2023-43633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-43633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-43633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-43633
Aliases
Downstream
Related
Published
2023-09-21T13:08:58.659Z
Modified
2026-07-15T01:49:07.954177406Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Debug Functions Unlockable Without Triggering Measured Boot
Details

On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”.

If the file exists, it overrides the existing configuration on the device on boot.

This allows an attacker to change the system’s configuration, which also includes some debug functions.

This could be used to unlock the ssh with custom “authorizedkeys” via the “debug.enable.ssh” key, similar to the “authorizedkeys” finding that was noted before.

Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usb” key, allowing VNC access via the “app.allow.vnc” key, and more.

An attacker could easily enable these debug functionalities without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable and it is not encrypted in any way.

An attacker can gain full control over the device without changing the PCR values, thereby not triggering the “measured boot” mechanism, and having full access to the vault.

Note:

This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13:

• aa3501d6c57206ced222c33aea15a9169d629141

• 5fef4d92e75838cc78010edaed5247dfbdae1889.

This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.

Database specific 
{
    "cwe_ids": [
        "CWE-522",
        "CWE-922"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43633.json",
    "cna_assigner": "ASRG"
}
References

Affected packages

Git / github.com/lf-edge/eve

Affected ranges

Type
GIT
Repo
https://github.com/lf-edge/eve
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9d9da94cf7d4986d6c15ce4c7d72d7d2ae6625c9
Introduced
eb72104ab35399a34c3cc88c2222f793f5f51c90
Fixed
c9e9dcb434803828b1c9972fbb02f87f76bd3153
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.6.0"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.5.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-43633.json"