GitHub Advisoryadvisory · Go

GHSA-6jp5-grgh-jw42 EVE Freely Allocates Buffer on The Stack With Data From Socket

MEDIUM Published 2026-02-04 Modified 2026-02-04 Official page ↗
Aliases
CVE-2023-43632
Ecosystem
Go
Packages
github.com/lf-edge/eve
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-770, CWE-789
Reviewed
2026-02-04

Affected packages

• Go github.com/lf-edge/eve: < 0.0.0-20230519072751-977f42b07fa9 → fixed in 0.0.0-20230519072751-977f42b07fa9

Description

Impact VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service. An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service. Patches Fixed in 9.4.3-lts and 10.1.0 Workarounds None

Related

Alias · CVE (1)

  • CVE-2023-43632 As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of… vulnerability

Weakness · CWE (2)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References