CVE-2023-43630
highpriority · track · 35EPSS 0.001 · 1 %ileEUUSEPSS · scored 2026-10-26
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.2–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
- linuxfoundation edge virtualization engine9.0.0 → 9.5.0nvdUScpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-phcg-h58r-gmcqEVE Doesn't Measure Config Partition From 2 Fronts2026-02-04ghsa · osvUS
### Impact PCR14 is not included in the list of PCRs that seal/unseal the vault key. Additionally, the vault key uses SHA1 PCRs instead of SHA256. Thus an attacker with physical access can take out the disk, use a different computer to modify the files in the /config partition, and re-insert the disk and boot without the change being detected by measured boot and remote attestation. ### Patches Fixed in EVE version 9.4.3-lts ### Workarounds None (apart from preventing physical access to the device) ### Resources https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a
- GO-2026-4430EVE Doesn't Measure Config Partition From 2 Fronts in github.com/lf-edge/eve2026-02-05vendor · osvUS
EVE Doesn't Measure Config Partition From 2 Fronts in github.com/lf-edge/eve
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://asrg.io/security-advisories/config-partition-not-measured-from-2-fronts/cnnvd
- https://asrg.io/security-advisories/cve-2023-43630/cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-43630/cnnvd
- https://asrg.io/security-advisories/cve-2023-43630/enisa_euvd
- https://asrg.io/security-advisories/cve-2023-43630/nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan