CVE-2023-43635
📋 TL;DR
This vulnerability in EVE OS's measured boot mechanism allows attackers to bypass TPM-based encryption of the sensitive 'vault' directory. The system incorrectly seals encryption keys using insecure SHA1 PCRs instead of SHA256 PCRs, enabling unauthorized access to protected data. This affects systems running vulnerable versions of EVE OS with measured boot enabled.
💻 Affected Systems
- EVE OS
📦 What is this software?
Edge Virtualization Engine by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the encrypted vault directory, exposing all sensitive system data including credentials, certificates, and configuration secrets to attackers.
Likely Case
Unauthorized access to encrypted vault contents, potentially leading to credential theft, configuration tampering, and system compromise.
If Mitigated
Limited impact if vault contains minimal sensitive data or if additional encryption layers protect critical information.
🎯 Exploit Status
Exploitation requires physical or administrative access to the system to interact with TPM and vault mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references
Vendor Advisory: https://asrg.io/security-advisories/cve-2023-43635/
Restart Required: Yes
Instructions:
1. Check vendor advisory for patched version. 2. Update EVE OS to patched version. 3. Reboot system to apply changes. 4. Re-seal vault keys with SHA256 PCRs.
🔧 Temporary Workarounds
Disable measured boot
linuxTemporarily disable the measured boot mechanism to prevent use of vulnerable PCR sealing
Specific commands unavailable from provided data
Enable SHA256 PCRs
linuxEnsure SHA256 PCRs are enabled in TPM configuration
tpm2_pcrread sha256
tpm2_pcrextend
🧯 If You Can't Patch
- Isolate affected systems from sensitive networks
- Implement additional encryption layer for vault contents
🔍 How to Verify
Check if Vulnerable:
Check if vault keys are sealed with SHA1 PCRs instead of SHA256 PCRs in TPM configurationCheck Version:
eve-version or check OS version through vendor toolsVerify Fix Applied:
Verify vault keys are now sealed using SHA256 PCRs and cannot be unsealed with SHA1 PCRs📡 Detection & Monitoring
Log Indicators:
- Failed vault decryption attempts
- TPM PCR extension events using SHA1
Network Indicators:
- Unusual access patterns to vault directory
SIEM Query:
Search for TPM events with PCR operations using SHA1 algorithm