CVE-2023-43633

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43633", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2023-09-20T14:34:14.874Z", "datePublished": "2023-09-21T13:08:58.659Z", "dateUpdated": "2024-09-24T17:00:40.426Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "EVE OS", "product": "EVE OS", "programFiles": ["https://github.com/lf-edge/eve/tree/master/pkg/pillar/evetpm/tpm.go", "https://github.com/lf-edge/eve/tree/master/pkg/grub/rootfs.cfg"], "repo": "https://github.com/lf-edge/eve", "vendor": " LF-Edge, Zededa", "versions": [{"lessThan": "8.6.0", "status": "affected", "version": "0", "versionType": "release"}, {"lessThan": "9.5.0", "status": "affected", "version": "9.0.0", "versionType": "release"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ilay Levi"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n<br>If the file exists, it overrides the existing configuration on the device on boot.\n<br>This allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n<br>This could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n<br>Other usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n<br>An attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.<br><br>\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n<br><br>Note:\n<br>This issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n<br>\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n<br>\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n<br>This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot."}], "value": "\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n\nIf the file exists, it overrides the existing configuration on the device on boot.\n\nThis allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n\nThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n\nOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n\nAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.\n\n\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n\n\nNote:\n\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2023-09-28T05:33:11.251Z"}, "references": [{"url": "https://asrg.io/security-advisories/cve-2023-43633/"}], "source": {"discovery": "UNKNOWN"}, "title": "Debug Functions Unlockable Without Triggering Measured Boot", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:43.779Z"}, "title": "CVE Program Container", "references": [{"url": "https://asrg.io/security-advisories/cve-2023-43633/", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "lfedge", "product": "eve", "cpes": ["cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "8.6.0", "versionType": "custom"}, {"version": "9.0.0", "status": "affected", "lessThan": "9.5.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-24T16:59:36.660433Z", "id": "CVE-2023-43633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T17:00:40.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://asrg.io/security-advisories/cve-2023-43633/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:43.779Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-43633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-24T16:59:36.660433Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*"], "vendor": "lfedge", "product": "eve", "versions": [{"status": "affected", "version": "0", "lessThan": "8.6.0", "versionType": "custom"}, {"status": "affected", "version": "9.0.0", "lessThan": "9.5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-24T17:00:37.018Z"}}], "cna": {"title": "Debug Functions Unlockable Without Triggering Measured Boot", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ilay Levi"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/lf-edge/eve", "vendor": " LF-Edge, Zededa", "product": "EVE OS", "versions": [{"status": "affected", "version": "0", "lessThan": "8.6.0", "versionType": "release"}, {"status": "affected", "version": "9.0.0", "lessThan": "9.5.0", "versionType": "release"}], "packageName": "EVE OS", "programFiles": ["https://github.com/lf-edge/eve/tree/master/pkg/pillar/evetpm/tpm.go", "https://github.com/lf-edge/eve/tree/master/pkg/grub/rootfs.cfg"], "defaultStatus": "unaffected"}], "references": [{"url": "https://asrg.io/security-advisories/cve-2023-43633/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n\nIf the file exists, it overrides the existing configuration on the device on boot.\n\nThis allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n\nThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n\nOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n\nAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.\n\n\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n\n\nNote:\n\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.", "supportingMedia": [{"type": "text/html", "value": "\n\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n<br>If the file exists, it overrides the existing configuration on the device on boot.\n<br>This allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n<br>This could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n<br>Other usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n<br>An attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.<br><br>\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n<br><br>Note:\n<br>This issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n<br>\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n<br>\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n<br>This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-922", "description": "CWE-922 Insecure Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2023-09-28T05:33:11.251Z"}}}, "cveMetadata": {"cveId": "CVE-2023-43633", "state": "PUBLISHED", "dateUpdated": "2024-09-24T17:00:40.426Z", "dateReserved": "2023-09-20T14:34:14.874Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2023-09-21T13:08:58.659Z", "assignerShortName": "ASRG"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "EVE OS", "product": "EVE OS", "programFiles": ["https://github.com/lf-edge/eve/tree/master/pkg/pillar/evetpm/tpm.go", "https://github.com/lf-edge/eve/tree/master/pkg/grub/rootfs.cfg"], "repo": "https://github.com/lf-edge/eve", "vendor": " LF-Edge, Zededa", "versions": [{"lessThan": "8.6.0", "status": "affected", "version": "0", "versionType": "release"}, {"lessThan": "9.5.0", "status": "affected", "version": "9.0.0", "versionType": "release"}]}], "source": "cve@asrg.io"}, {"affectedData": [{"cpes": ["cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "eve", "vendor": "lfedge", "versions": [{"lessThan": "8.6.0", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "9.5.0", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*", "matchCriteriaId": "95D311A8-5FBD-49AF-AD11-8B78420BAEAE", "versionEndExcluding": "8.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*", "matchCriteriaId": "A3648A14-186C-4E6A-AA73-7D2F5C78019D", "versionEndExcluding": "9.5.0", "versionStartIncluding": "9.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n\nIf the file exists, it overrides the existing configuration on the device on boot.\n\nThis allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n\nThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n\nOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n\nAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.\n\n\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n\n\nNote:\n\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot."}, {"lang": "es", "value": "Al arrancar, el contenedor Pillar eve comprueba la existencia y el contenido de \u201c/config/GlobalConfig/global.json\u201d. Si el archivo existe, anula la configuraci\u00f3n existente en el dispositivo al arrancar. Esto permite a un atacante cambiar la configuraci\u00f3n del sistema, que tambi\u00e9n incluye algunas funciones de depuraci\u00f3n. Esto podr\u00eda usarse para desbloquear el ssh con \u201cclaves_autorizadas\u201d personalizadas a trav\u00e9s de la clave \u201cdebug.enable.ssh\u201d, similar al hallazgo de \u201cclaves_autorizadas\u201d que se se\u00f1al\u00f3 anteriormente. Otros usos incluyen desbloquear el USB para habilitar el teclado mediante la tecla \"\"debug.enable.usb\"\", permitir el acceso a VNC mediante la tecla \"\"app.allow.vnc\"\" y m\u00e1s. Un atacante podr\u00eda habilitar f\u00e1cilmente estas funcionalidades de depuraci\u00f3n sin activar el mecanismo de \"\"measured boot\"\" implementado por EVE OS y sin marcar el dispositivo como \"\"UUD\"\" (\"\"Actualizaci\u00f3n desconocida detectada\"\"). Esto se debe a que la partici\u00f3n \u201c/config\u201d no est\u00e1 protegida por \u201cmeasured boot\u201d, es mutable y no est\u00e1 cifrada de ninguna manera. Un atacante puede obtener control total sobre el dispositivo sin cambiar los valores de PCR, por lo que no activar\u00e1 el mecanismo de \"\"measured boot\"\" y tendr\u00e1 acceso completo a \"\"vault\"\". Nota: Este problema se solucion\u00f3 parcialmente en estos commits (despu\u00e9s de la divulgaci\u00f3n a Zededa), donde la medici\u00f3n de la partici\u00f3n de configuraci\u00f3n se agreg\u00f3 a PCR13: \n\u2022 aa3501d6c57206ced222c33aea15a9169d629141 \n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889. \nEste problema se hizo viable en la versi\u00f3n 9.0.0 cuando el c\u00e1lculo se traslad\u00f3 a PCR14, pero no se incluy\u00f3 en el \"\"measured boot\"\"."}], "id": "CVE-2023-43633", "lastModified": "2026-06-17T06:26:07.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "cve@asrg.io", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-43633", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-09-24T16:59:36.660433Z", "version": "2.0.3"}}]}, "published": "2023-09-21T14:15:11.330", "references": [{"source": "cve@asrg.io", "tags": ["Third Party Advisory"], "url": "https://asrg.io/security-advisories/cve-2023-43633/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://asrg.io/security-advisories/cve-2023-43633/"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-922"}], "source": "cve@asrg.io", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}