GitHub Advisoryadvisory · Go
GHSA-5h7v-g49c-h887 EVE Doesn't Protect Rootfs
MEDIUM
Official page ↗
- Aliases
- CVE-2023-43636
- Ecosystem
- Go
- Packages
- github.com/lf-edge/eve/pkg/grub
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Weaknesses
- CWE-345
- Reviewed
- 2026-02-04
Affected packages
• Go github.com/lf-edge/eve/pkg/grub: < 0.0.0-20220708121648-5fef4d92e758 → fixed in 0.0.0-20220708121648-5fef4d92e758
Description
Impact
Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.
Patches
Fixed in 8.6.0 and 8.12.1-lts
Workarounds
None
Related
Alias · CVE (1)
- CVE-2023-43636 In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. vulnerability
Weakness · CWE (1)
- CWE-345 Insufficient Verification of Data Authenticity weakness
References
- https://github.com/lf-edge/eve/security/advisories/GHSA-5h7v-g49c-h887 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-43636 advisory
- https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889 web
- https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141 web
- https://asrg.io/security-advisories/19274 web
- https://asrg.io/security-advisories/cve-2023-43636 web
- https://github.com/lf-edge/eve package