{"cve":"CVE-2023-43634","nvd":{"published":"2023-09-21T14:15:11.477","modified":"2026-06-17T06:26:07.170","status":"Modified","description":"When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs\nare used.\n\nIn a previous project, CYMOTIVE found that the configuration is not protected by the secure\nboot, and in response Zededa implemented measurements on the config partition that was\nmapped to PCR 13.\n\nIn that process, PCR 13 was added to the list of PCRs that seal/unseal the key.\n\nIn commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition\nmeasurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of\nPCRs that seal/unseal the key.\n\nThis change makes the measurement of PCR 14 effectively redundant as it would not affect\nthe sealing/unsealing of the key.\n\n\n\nAn attacker could modify the config partition without triggering the measured boot, this could\nresult in the attacker gaining full control over the device with full access to the contents of the\nencrypted “vault”","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8},"cwes":["CWE-522","CWE-922"],"references":["https://asrg.io/security-advisories/cve-2023-43634/","https://asrg.io/security-advisories/cve-2023-43634/"],"products":["lfedge:eve"],"source":"nvd","synced_at":"2026-10-19T21:39:24.235896374+00:00"},"epss":{"cve":"CVE-2023-43634","score":0.00171,"percentile":0.06424,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-wc42-fcjp-v8vq","url":"https://osv.dev/vulnerability/GHSA-wc42-fcjp-v8vq","summary":"EVE Doesn't Protect Config Partition with Measured Boot","modified":"2026-02-05T04:11:08.452498Z","packages":[{"ecosystem":"Go","name":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","ranges":["<0.0.0-20230519072751-977f42b07fa9"],"fixed":["0.0.0-20230519072751-977f42b07fa9"]}]},{"id":"GO-2026-4432","url":"https://osv.dev/vulnerability/GO-2026-4432","summary":"EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve","modified":"2026-02-05T04:11:08.452498Z","packages":[{"ecosystem":"Go","name":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","ranges":["<0.0.0-20230519072751-977f42b07fa9"],"fixed":["0.0.0-20230519072751-977f42b07fa9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}