2019 matches found
CVE-2023-43634 Config Partition Not Protected by Measured Boot
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. I...
CVE-2023-43634
CVE-2023-43634 relates to the EVE project: the config partition is measured for TPM PCRs used to seal/unseal the vault key. A change moved the config partition measurement from PCR 13 to PCR 14, but PCR 14 was not added to the sealing/unsealing list, making PCR 14’s measurement effectively redund...
EVE OS Security Vulnerability
EVE OS is a general-purpose, open Linux-based operating system for distributed edge computing open-sourced by IF Edge. A security vulnerability exists in EVE OS that stems from a configuration partition that is not protected by measured boot...
GHSA-5JVG-8J6F-VPMC Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-phcg-h58r-gmcq. This link is maintained to preserve external references. Original Description PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in comm...
Duplicate Advisory: EVE Doesn't Measure Config Partition From 2 Fronts
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-phcg-h58r-gmcq. This link is maintained to preserve external references. Original Description PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in comm...
Duplicate Advisory: EVE Doesn't Protect Rootfs
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wc42-fcjp-v8vq. This link is maintained to preserve external references. Original Description In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in t...
CVE-2023-43636
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This...
Design/Logic Flaw
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This...
CVE-2023-43636 Rootfs Not Protected
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This...
CVE-2023-43636 Rootfs Not Protected
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This...
CVE-2023-43630 Config Partition Not Measured From 2 Fronts
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is...
CVE-2023-43630 Config Partition Not Measured From 2 Fronts
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is...
CVE-2023-43630
CVE-2023-43630 documents a TPM/Measured Boot issue in the EVE project (lf-edge/eve) where PCR14 is not in the sealing/unsealing list for the vault key, and the vault key is sealed with SHA1 PCRs instead of SHA256. A code change (commit 7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4) meant that PCR14 up...
CVE-2023-43630 Config Partition Not Measured From 2 Fronts
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is...
PT-2023-28886
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue concerns a problem where PCR14 is not in the list of PCRs that seal/unseal the "vault" key. Due to a change implemented in a commit, fixing this...
EVE OS Security Vulnerability
EVE OS is a general-purpose, open Linux-based operating system for distributed edge computing open-sourced by IF Edge. EVE OS suffers from a security vulnerability that stems from PCR14 not properly measuring the configuration partition. An attacker could use the vulnerability to modify the...
CVE-2023-38352
MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack...
CVE-2023-38352
MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in the middle attack...
