lf-edge/eve · Security
EVE Doesn't Protect Rootfs
- GHSA ID
- GHSA-5h7v-g49c-h887
- CVE ID
- CVE-2023-43636
- Severity
- medium
- Published
- Updated
- CVSS
- 6.7 · CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- CVSS v3
- 6.7 · CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Description
Impact
Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.
Patches
Fixed in 8.6.0 and 8.12.1-lts
Workarounds
None
CWEs
- CWE-345 · Insufficient Verification of Data Authenticity
References
- https://github.com/lf-edge/eve/security/advisories/GHSA-5h7v-g49c-h887 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-43636 ↗
- https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889 ↗
- https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141 ↗
- https://asrg.io/security-advisories/19274 ↗
- https://asrg.io/security-advisories/cve-2023-43636 ↗
- https://github.com/advisories/GHSA-5h7v-g49c-h887 ↗