{"cve":"CVE-2023-43635","nvd":{"published":"2023-09-20T15:15:11.987","modified":"2026-06-17T06:26:07.393","status":"Modified","description":"Vault Key Sealed With SHA1 PCRs\n\n\n\n\n\n\nThe measured boot solution implemented in EVE OS leans on a PCR locking mechanism.\n\nDifferent parts of the system update different PCR values in the TPM, resulting in a unique\nvalue for each PCR entry.\n\nThese PCRs are then used in order to seal/unseal a key from the TPM which is used to\nencrypt/decrypt the “vault” directory.\n\nThis “vault” directory is the most sensitive point in the system and as such, its content should\nbe protected.\n\nThis mechanism is noted in Zededa’s documentation as the “measured boot” mechanism,\ndesigned to protect said “vault”.\n\nThe code that’s responsible for generating and fetching the key from the TPM assumes that\nSHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being\nchecked.\n\nThe issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs.\nThis leads to several issues:\n\n• Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well\nas not sealing their keys at all, meaning the “vault” is not protected from an attacker.\n\n• SHA1 is considered insecure and reduces the complexity level required to unseal the\nkey in machines which have their SHA1 PCRs enabled.\n\n\n\nAn attacker can very easily retrieve the contents of the “vault”, which will effectively render\nthe “measured boot” mechanism meaningless.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":8.8},"cwes":["CWE-327","CWE-328","CWE-522"],"references":["https://asrg.io/security-advisories/cve-2023-43635/","https://asrg.io/security-advisories/cve-2023-43635/"],"products":["linuxfoundation:edge_virtualization_engine"],"source":"nvd","synced_at":"2026-10-19T21:39:24.235896374+00:00"},"epss":{"cve":"CVE-2023-43635","score":0.00117,"percentile":0.01654,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-4jvr-vj2c-8q37","url":"https://osv.dev/vulnerability/GHSA-4jvr-vj2c-8q37","summary":"EVE Seals Vault Key With SHA1 PCRs","modified":"2026-02-19T20:41:22.297357Z","packages":[{"ecosystem":"Go","name":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","ranges":["<0.0.0-20230519072751-977f42b07fa9"],"fixed":["0.0.0-20230519072751-977f42b07fa9"]}]},{"id":"GO-2026-4434","url":"https://osv.dev/vulnerability/GO-2026-4434","summary":"EVE Seals Vault Key With SHA1 PCRs in github.com/lf-edge/eve","modified":"2026-02-19T20:41:22.297357Z","packages":[{"ecosystem":"Go","name":"github.com/lf-edge/eve","purl":"pkg:golang/github.com/lf-edge/eve","ranges":["<0.0.0-20230519072751-977f42b07fa9"],"fixed":["0.0.0-20230519072751-977f42b07fa9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}