high8.8
CVE-2023-43633
EVE's Debug Functions Unlockable Without Triggering Measured Boot
Impact
### Impact On boot, Pillar checks for /config/GlobalConfig/global.json and overrides system configuration if present. This allows enabling debug functions like SSH (debug.enable.ssh), USB keyboard (debug.enable.usb), and VNC access (app.allow.vnc) without triggering the measured boot. Thus, a user with physical access can take out the disk and modify the content of this file in the /config partition and then re-insert the disk. ### Patches Fixed in 10.1.0 and 9.4.3-lts ### Workarounds None
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/lf-edge/eve | < 0.0.0-20220708121648-5fef4d92e758 | 0.0.0-20220708121648-5fef4d92e758 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lfedge | Eve | before 8.6.0 from 9.0.0 before 9.5.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://asrg.io/security-advisories/cve-2023-43633/
- https://github.com/advisories/GHSA-4c4v-42hc-72p6
- https://github.com/lf-edge/eve/security/advisories/GHSA-4c4v-42hc-72p6
- https://nvd.nist.gov/vuln/detail/CVE-2023-43633
- https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889
- https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141
- https://asrg.io/security-advisories/cve-2023-43633
- https://asrg.io/security-advisories/debug-functions-unlockable-without-triggering-measured-boot