CVE-2023-43635: Vault Key Sealed With SHA1 PCRs
Impact
The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs
Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content.
Patches
Fixed in 9.4.3-lts and 10.1.0
Workarounds
None
Other sources
Vault Key Sealed With SHA1 PCRs
The measured boot solution implemented in EVE OS leans on a PCR locking mechanism.
Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry.
These PCRs are then used in order to seal/unseal a key from the TPM which is used to encrypt/decrypt the “vault” directory.
This “vault” directory is the most sensitive point in the system and as such, its content should be protected.
This mechanism is noted in Zededa’s documentation as the “measured boot” mechanism, designed to protect said “vault”.
The code that’s responsible for generating and fetching the key from the TPM assumes that SHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being checked.
The issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs. This leads to several issues:
• Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well as not sealing their keys at all, meaning the “vault” is not protected from an attacker.
• SHA1 is considered insecure and reduces the complexity level required to unseal the key in machines which have their SHA1 PCRs enabled.
An attacker can very easily retrieve the contents of the “vault”, which will effectively render the “measured boot” mechanism meaningless.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-43635?
CVE-2023-43635 is a vulnerability in the Vault Key Sealed With SHA1 PCRs in the Linuxfoundation Edge Virtualization Engine.
What is the severity of CVE-2023-43635?
The severity of CVE-2023-43635 is high with a CVSS score of 8.8.
How does the measured boot solution in EVE OS rely on PCR locking?
The measured boot solution in EVE OS relies on PCR locking to update different PCR values in the TPM, resulting in a unique value for each PCR entry.
What is the affected software for CVE-2023-43635?
The affected software for CVE-2023-43635 is Linuxfoundation Edge Virtualization Engine version up to exclusive 9.5.0.
How can I fix CVE-2023-43635?
To fix CVE-2023-43635, it is recommended to update the Linuxfoundation Edge Virtualization Engine to a version higher than 9.5.0.