CVE-2023-43635 affects the Linux Foundation's Edge Virtualization Engine (EVE OS), specifically its measured boot solution. The vulnerability stems from the system incorrectly sealing the sensitive "vault" directory's encryption key with insecure SHA1 PCRs instead of the intended SHA256 PCRs, or in some cases, not sealing it at all. This flaw allows an attacker to easily retrieve the vault's contents, rendering the measured boot mechanism ineffective. This vulnerability is rated as High severity (CVSS 8.8), indicating a local attack vector with low attack complexity, requiring low privileges, and resulting in high impact to confidentiality, integrity, and availability. The use of SHA1 significantly weakens the protection. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.5.0CPE matchmatch criteria | cpe:2.3:o:linuxfoundation:edge_virtualization_engine:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.