CVE-2023-43630
Assigner: ASRG
Published: 2023-09-20T14:37:44.564Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: EVE OS
product: EVE OS
programFiles: https://github.com/lf-edge/eve/blob/master/pkg/measure-config/src/measurefs.go
https://github.com/lf-edge/eve/blob/master/pkg/pillar/evetpm/tpm.go
repo: https://github.com/lf-edge/eve
vendor:  LF-Edge, Zededa
versions: lessThan: 9.5.0
status: affected
version: 9.0.0
versionType: release
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Ilay Levi
datePublic: 2023-09-20T14:35:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but
due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the
problem of the config partition not being measured correctly.
<br>Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of
SHA256. <br>This issue was somewhat mitigated due to all of the PCR extend functions
updating both the values of SHA256 and SHA1 for a given PCR ID.
<br>However, due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as
the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which
means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault”
key, changes to the config partition would still not be measured.<br><br>

An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault” 



<br>
value: PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but
due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the
problem of the config partition not being measured correctly.

Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of
SHA256. 
This issue was somewhat mitigated due to all of the PCR extend functions
updating both the values of SHA256 and SHA1 for a given PCR ID.

However, due to the change that was implemented in commit
“7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as
the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which
means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault”
key, changes to the config partition would still not be measured.



An attacker could modify the config partition without triggering the measured boot, this could
result in the attacker gaining full control over the device with full access to the contents of the
encrypted “vault” 





impacts: capecId: CAPEC-115
descriptions: value: CAPEC-115 Authentication Bypass
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-522
description: CWE-522 Insufficiently Protected Credentials
type: CWE
descriptions: cweId: CWE-922
description: CWE-922 Insecure Storage of Sensitive Information
type: CWE
descriptions: cweId: CWE-328
description: CWE-328 Use of Weak Hash
type: CWE
source: discovery: UNKNOWN
title: Config Partition Not Measured From 2 Fronts
x_generator: engine: Vulnogram 0.1.0-dev