CVE-2023-43630

CVE-2023-43630 affects Linux Foundation Edge Virtualization Engine, where a critical flaw allows an attacker to bypass measured boot protections. The "vault" key, which protects sensitive data, is sealed using SHA1 PCRs instead of the more secure SHA256, and specifically, PCR14's SHA1 value is not updated correctly. This enables an attacker with local privileges to modify the configuration partition without detection. The vulnerability has a CVSS score of 8.8 (HIGH), indicating a low attack complexity and the potential for complete compromise of the device, including full access to encrypted "vault" contents. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.