EVE Freely Allocates Buffer on The Stack With Data From Socket
### Impact VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service. An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service. ### Patches Fixed in 9.4.3-lts and 10.1.0 ### Workarounds None
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-43632US | critical9.9 | — | ||
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port
8877 in EVE, exposing limited functionality of the TPM to the clients.
VTPM allows cl… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://asrg.io/security-advisories/cve-2023-43632WEB
- https://asrg.io/security-advisories/freely-allocate-buffer-on-the-stack-with-data-from-socketWEB
- https://github.com/lf-edge/evePACKAGE
- https://github.com/lf-edge/eve/security/advisories/GHSA-6jp5-grgh-jw42WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-43632ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan