CVE-2023-43633 (GCVE-0-2023-43633)
Vulnerability from cvelistv5
Published
2023-09-21 13:08
Modified
2024-09-24 17:00
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-522 - Insufficiently Protected Credentials
  • CWE-922 - Insecure Storage of Sensitive Information
Summary
On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing configuration on the device on boot. This allows an attacker to change the system’s configuration, which also includes some debug functions. This could be used to unlock the ssh with custom “authorized_keys” via the “debug.enable.ssh” key, similar to the “authorized_keys” finding that was noted before. Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usb” key, allowing VNC access via the “app.allow.vnc” key, and more. An attacker could easily enable these debug functionalities without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thereby not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13: • aa3501d6c57206ced222c33aea15a9169d629141 • 5fef4d92e75838cc78010edaed5247dfbdae1889. This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
References
Impacted products
Vendor Product Version
LF-Edge, Zededa EVE OS Version: 0
Version: 9.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:44:43.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://asrg.io/security-advisories/cve-2023-43633/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "eve",
            "vendor": "lfedge",
            "versions": [
              {
                "lessThan": "8.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.5.0",
                "status": "affected",
                "version": "9.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-43633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T16:59:36.660433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T17:00:40.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "EVE OS",
          "product": "EVE OS",
          "programFiles": [
            "https://github.com/lf-edge/eve/tree/master/pkg/pillar/evetpm/tpm.go",
            "https://github.com/lf-edge/eve/tree/master/pkg/grub/rootfs.cfg"
          ],
          "repo": "https://github.com/lf-edge/eve",
          "vendor": " LF-Edge, Zededa",
          "versions": [
            {
              "lessThan": "8.6.0",
              "status": "affected",
              "version": "0",
              "versionType": "release"
            },
            {
              "lessThan": "9.5.0",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "release"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ilay Levi"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n\u003cbr\u003eIf the file exists, it overrides the existing configuration on the device on boot.\n\u003cbr\u003eThis allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n\u003cbr\u003eThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n\u003cbr\u003eOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n\u003cbr\u003eAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.\u003cbr\u003e\u003cbr\u003e\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n\u003cbr\u003e\u003cbr\u003eNote:\n\u003cbr\u003eThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n\u003cbr\u003e\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n\u003cbr\u003e\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n\u003cbr\u003eThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot."
            }
          ],
          "value": "\nOn boot, the Pillar eve container checks for the existence and content of\n\u201c/config/GlobalConfig/global.json\u201d.\n\nIf the file exists, it overrides the existing configuration on the device on boot.\n\nThis allows an attacker to change the system\u2019s configuration, which also includes some\ndebug functions.\n\nThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\n\nOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\n\nAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\n(\u201cUnknown Update Detected\u201d).\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\nis not encrypted in any way.\n\n\n\n\n\nAn attacker can gain full control over the device without changing the PCR values, thereby not\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\n\n\n\n\nNote:\n\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\npartition measurement was added to PCR13:\n\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141\n\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\n\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-922",
              "description": "CWE-922 Insecure Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-28T05:33:11.251Z",
        "orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
        "shortName": "ASRG"
      },
      "references": [
        {
          "url": "https://asrg.io/security-advisories/cve-2023-43633/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Debug Functions Unlockable Without Triggering Measured Boot",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba",
    "assignerShortName": "ASRG",
    "cveId": "CVE-2023-43633",
    "datePublished": "2023-09-21T13:08:58.659Z",
    "dateReserved": "2023-09-20T14:34:14.874Z",
    "dateUpdated": "2024-09-24T17:00:40.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-43633\",\"sourceIdentifier\":\"cve@asrg.io\",\"published\":\"2023-09-21T14:15:11.330\",\"lastModified\":\"2024-11-21T08:24:30.617\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\nOn boot, the Pillar eve container checks for the existence and content of\\n\u201c/config/GlobalConfig/global.json\u201d.\\n\\nIf the file exists, it overrides the existing configuration on the device on boot.\\n\\nThis allows an attacker to change the system\u2019s configuration, which also includes some\\ndebug functions.\\n\\nThis could be used to unlock the ssh with custom \u201cauthorized_keys\u201d via the\\n\u201cdebug.enable.ssh\u201d key, similar to the \u201cauthorized_keys\u201d finding that was noted before.\\n\\nOther usages include unlocking the usb to enable the keyboard via the \u201cdebug.enable.usb\u201d\\nkey, allowing VNC access via the \u201capp.allow.vnc\u201d key, and more.\\n\\nAn attacker could easily enable these debug functionalities without triggering the \u201cmeasured\\nboot\u201d mechanism implemented by EVE OS, and without marking the device as \u201cUUD\u201d\\n(\u201cUnknown Update Detected\u201d).\\nThis is because the \u201c/config\u201d partition is not protected by \u201cmeasured boot\u201d, it is mutable and it\\nis not encrypted in any way.\\n\\n\\n\\n\\n\\nAn attacker can gain full control over the device without changing the PCR values, thereby not\\ntriggering the \u201cmeasured boot\u201d mechanism, and having full access to the vault.\\n\\n\\n\\n\\nNote:\\n\\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\\npartition measurement was added to PCR13:\\n\\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141\\n\\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\\n\\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.\"},{\"lang\":\"es\",\"value\":\"Al arrancar, el contenedor Pillar eve comprueba la existencia y el contenido de \u201c/config/GlobalConfig/global.json\u201d. Si el archivo existe, anula la configuraci\u00f3n existente en el dispositivo al arrancar. Esto permite a un atacante cambiar la configuraci\u00f3n del sistema, que tambi\u00e9n incluye algunas funciones de depuraci\u00f3n. Esto podr\u00eda usarse para desbloquear el ssh con \u201cclaves_autorizadas\u201d personalizadas a trav\u00e9s de la clave \u201cdebug.enable.ssh\u201d, similar al hallazgo de \u201cclaves_autorizadas\u201d que se se\u00f1al\u00f3 anteriormente. Otros usos incluyen desbloquear el USB para habilitar el teclado mediante la tecla \\\"\\\"debug.enable.usb\\\"\\\", permitir el acceso a VNC mediante la tecla \\\"\\\"app.allow.vnc\\\"\\\" y m\u00e1s. Un atacante podr\u00eda habilitar f\u00e1cilmente estas funcionalidades de depuraci\u00f3n sin activar el mecanismo de \\\"\\\"measured boot\\\"\\\" implementado por EVE OS y sin marcar el dispositivo como \\\"\\\"UUD\\\"\\\" (\\\"\\\"Actualizaci\u00f3n desconocida detectada\\\"\\\"). Esto se debe a que la partici\u00f3n \u201c/config\u201d no est\u00e1 protegida por \u201cmeasured boot\u201d, es mutable y no est\u00e1 cifrada de ninguna manera. Un atacante puede obtener control total sobre el dispositivo sin cambiar los valores de PCR, por lo que no activar\u00e1 el mecanismo de \\\"\\\"measured boot\\\"\\\" y tendr\u00e1 acceso completo a \\\"\\\"vault\\\"\\\". Nota: Este problema se solucion\u00f3 parcialmente en estos commits (despu\u00e9s de la divulgaci\u00f3n a Zededa), donde la medici\u00f3n de la partici\u00f3n de configuraci\u00f3n se agreg\u00f3 a PCR13: \\n\u2022 aa3501d6c57206ced222c33aea15a9169d629141 \\n\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889. \\nEste problema se hizo viable en la versi\u00f3n 9.0.0 cuando el c\u00e1lculo se traslad\u00f3 a PCR14, pero no se incluy\u00f3 en el \\\"\\\"measured boot\\\"\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@asrg.io\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"cve@asrg.io\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"},{\"lang\":\"en\",\"value\":\"CWE-922\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.6.0\",\"matchCriteriaId\":\"95D311A8-5FBD-49AF-AD11-8B78420BAEAE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.0.0\",\"versionEndExcluding\":\"9.5.0\",\"matchCriteriaId\":\"A3648A14-186C-4E6A-AA73-7D2F5C78019D\"}]}]}],\"references\":[{\"url\":\"https://asrg.io/security-advisories/cve-2023-43633/\",\"source\":\"cve@asrg.io\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://asrg.io/security-advisories/cve-2023-43633/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://asrg.io/security-advisories/cve-2023-43633/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T19:44:43.779Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-43633\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-24T16:59:36.660433Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:lfedge:eve:*:*:*:*:*:*:*:*\"], \"vendor\": \"lfedge\", \"product\": \"eve\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.6.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"9.0.0\", \"lessThan\": \"9.5.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-24T17:00:37.018Z\"}}], \"cna\": {\"title\": \"Debug Functions Unlockable Without Triggering Measured Boot\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Ilay Levi\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/lf-edge/eve\", \"vendor\": \" LF-Edge, Zededa\", \"product\": \"EVE OS\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"8.6.0\", \"versionType\": \"release\"}, {\"status\": \"affected\", \"version\": \"9.0.0\", \"lessThan\": \"9.5.0\", \"versionType\": \"release\"}], \"packageName\": \"EVE OS\", \"programFiles\": [\"https://github.com/lf-edge/eve/tree/master/pkg/pillar/evetpm/tpm.go\", \"https://github.com/lf-edge/eve/tree/master/pkg/grub/rootfs.cfg\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://asrg.io/security-advisories/cve-2023-43633/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"\\nOn boot, the Pillar eve container checks for the existence and content of\\n\\u201c/config/GlobalConfig/global.json\\u201d.\\n\\nIf the file exists, it overrides the existing configuration on the device on boot.\\n\\nThis allows an attacker to change the system\\u2019s configuration, which also includes some\\ndebug functions.\\n\\nThis could be used to unlock the ssh with custom \\u201cauthorized_keys\\u201d via the\\n\\u201cdebug.enable.ssh\\u201d key, similar to the \\u201cauthorized_keys\\u201d finding that was noted before.\\n\\nOther usages include unlocking the usb to enable the keyboard via the \\u201cdebug.enable.usb\\u201d\\nkey, allowing VNC access via the \\u201capp.allow.vnc\\u201d key, and more.\\n\\nAn attacker could easily enable these debug functionalities without triggering the \\u201cmeasured\\nboot\\u201d mechanism implemented by EVE OS, and without marking the device as \\u201cUUD\\u201d\\n(\\u201cUnknown Update Detected\\u201d).\\nThis is because the \\u201c/config\\u201d partition is not protected by \\u201cmeasured boot\\u201d, it is mutable and it\\nis not encrypted in any way.\\n\\n\\n\\n\\n\\nAn attacker can gain full control over the device without changing the PCR values, thereby not\\ntriggering the \\u201cmeasured boot\\u201d mechanism, and having full access to the vault.\\n\\n\\n\\n\\nNote:\\n\\nThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\\npartition measurement was added to PCR13:\\n\\n\\u2022 aa3501d6c57206ced222c33aea15a9169d629141\\n\\n\\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\\n\\nThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\nOn boot, the Pillar eve container checks for the existence and content of\\n\\u201c/config/GlobalConfig/global.json\\u201d.\\n\u003cbr\u003eIf the file exists, it overrides the existing configuration on the device on boot.\\n\u003cbr\u003eThis allows an attacker to change the system\\u2019s configuration, which also includes some\\ndebug functions.\\n\u003cbr\u003eThis could be used to unlock the ssh with custom \\u201cauthorized_keys\\u201d via the\\n\\u201cdebug.enable.ssh\\u201d key, similar to the \\u201cauthorized_keys\\u201d finding that was noted before.\\n\u003cbr\u003eOther usages include unlocking the usb to enable the keyboard via the \\u201cdebug.enable.usb\\u201d\\nkey, allowing VNC access via the \\u201capp.allow.vnc\\u201d key, and more.\\n\u003cbr\u003eAn attacker could easily enable these debug functionalities without triggering the \\u201cmeasured\\nboot\\u201d mechanism implemented by EVE OS, and without marking the device as \\u201cUUD\\u201d\\n(\\u201cUnknown Update Detected\\u201d).\\nThis is because the \\u201c/config\\u201d partition is not protected by \\u201cmeasured boot\\u201d, it is mutable and it\\nis not encrypted in any way.\u003cbr\u003e\u003cbr\u003e\\n\\n\\n\\nAn attacker can gain full control over the device without changing the PCR values, thereby not\\ntriggering the \\u201cmeasured boot\\u201d mechanism, and having full access to the vault.\\n\\n\\n\u003cbr\u003e\u003cbr\u003eNote:\\n\u003cbr\u003eThis issue was partially fixed in these commits (after disclosure to Zededa), where the config\\npartition measurement was added to PCR13:\\n\u003cbr\u003e\\u2022 aa3501d6c57206ced222c33aea15a9169d629141\\n\u003cbr\u003e\\u2022 5fef4d92e75838cc78010edaed5247dfbdae1889.\\n\u003cbr\u003eThis issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-522\", \"description\": \"CWE-522 Insufficiently Protected Credentials\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-922\", \"description\": \"CWE-922 Insecure Storage of Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"c15abc07-96a9-4d11-a503-5d621bfe42ba\", \"shortName\": \"ASRG\", \"dateUpdated\": \"2023-09-28T05:33:11.251Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-43633\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-24T17:00:40.426Z\", \"dateReserved\": \"2023-09-20T14:34:14.874Z\", \"assignerOrgId\": \"c15abc07-96a9-4d11-a503-5d621bfe42ba\", \"datePublished\": \"2023-09-21T13:08:58.659Z\", \"assignerShortName\": \"ASRG\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.