CVE-2023-43634
highpriority · track · 35EPSS 0.002 · 6 %ileEUUSEPSS · scored 2026-10-28
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. In that process, PCR 13 was added to the list of PCRs that seal/unseal the key. In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of PCRs that seal/unseal the key. This change makes the measurement of PCR 14 effectively redundant as it would not affect the sealing/unsealing of the key. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-wc42-fcjp-v8vqEVE Doesn't Protect Config Partition with Measured Boot2026-02-04ghsa · osvUS
### Impact Config partition measurement was moved from PCR 13 to PCR 14 in a commit, but PCR 14 was not added to the list of PCRs that seal/unseal the vault key. As a result, an attacker can remove the disk, use another server to modify the files in the config partition, and then re-insert the disk. ### Patches Fixed in EVE version 9.4.3-lts ### Workarounds None (apart from preventing physical access to the device) ### Resources https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a
- GO-2026-4432EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve2026-02-05vendor · osvUS
EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://asrg.io/security-advisories/config-partition-not-protected-by-measured-boot/cnnvd
- https://asrg.io/security-advisories/cve-2023-43634/cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-43634/cnnvd
- https://asrg.io/security-advisories/cve-2023-43634/enisa_euvd
- https://asrg.io/security-advisories/cve-2023-43634/Third Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan