CVE-2023-43634
📋 TL;DR
This vulnerability allows attackers to modify the configuration partition on affected devices without triggering measured boot protections, potentially gaining full control and access to encrypted data. It affects systems using Zededa's implementation where PCR 14 measurements aren't properly included in key sealing/unsealing operations.
💻 Affected Systems
- Zededa Edge Computing Platform
📦 What is this software?
Eve by Lfedge
Eve by Lfedge
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full device control with access to encrypted vault contents, potentially compromising all protected data and system integrity.
Likely Case
Unauthorized configuration changes leading to privilege escalation, data exposure, or system compromise.
If Mitigated
With proper monitoring and access controls, impact limited to configuration tampering detection.
🎯 Exploit Status
Requires physical or privileged access to modify config partition and bypass measured boot
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after commit 56e589749c6ff58ded862d39535d43253b249acf fix
Vendor Advisory: https://asrg.io/security-advisories/cve-2023-43634/
Restart Required: Yes
Instructions:
1. Update to patched version from vendor. 2. Verify PCR 14 is included in sealing/unsealing list. 3. Reboot system to apply changes.
🔧 Temporary Workarounds
Manual PCR List Update
linuxManually add PCR 14 to the list of PCRs used for key sealing/unsealing operations
# Requires platform-specific commands to update PCR list in secure boot configuration
🧯 If You Can't Patch
- Implement strict physical access controls to prevent unauthorized device access
- Enable enhanced monitoring of configuration partition changes and boot process
🔍 How to Verify
Check if Vulnerable:
Check if PCR 14 is missing from the list of PCRs used for vault key sealing/unsealing in secure boot configurationCheck Version:
Check system version against vendor's patched release informationVerify Fix Applied:
Verify PCR 14 is now included in the PCR list for sealing/unsealing operations and config partition measurements📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration partition modifications
- Measured boot PCR validation failures
- Unauthorized boot process changes
Network Indicators:
- Unusual device configuration updates
- Anomalous secure boot attestation patterns
SIEM Query:
Search for events related to configuration partition changes outside of authorized maintenance windows