Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/lf-edge/eve < 0.0.0-20220310190112-c0c966dc31e2
Fixed in
0.0.0-20220310190112-c0c966dc31e2· Vendor fix available
Issue
Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key. Patches Fixed in 7.10 and 8.12.1-lts Workarounds None
Recommended action: Upgrade to 0.0.0-20220310190112-c0c966dc31e2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20230519072751-977f42b07fa9
Fixed in
0.0.0-20230519072751-977f42b07fa9· Vendor fix available
Issue
Impact The vault key is sealed using SHA1 PCRs instead of SHA256 PCRs Thus an attacker with physical access to an EVE-OS device can try to brute force creating a kernel or rootfs image which produces the same SHA1 PCR but with malicious content. Patches Fixed in 9.4.3-lts and 10.1.0 Workarounds None
Recommended action: Upgrade to 0.0.0-20230519072751-977f42b07fa9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20230519072751-977f42b07fa9
Fixed in
0.0.0-20230519072751-977f42b07fa9· Vendor fix available
Issue
Impact Config partition measurement was moved from PCR 13 to PCR 14 in a commit, but PCR 14 was not added to the list of PCRs that seal/unseal the vault key. As a result, an attacker can remove the disk, use another server to modify the files in the config partition, and then re-insert the disk. Patches Fixed in EVE version 9.4.3-lts Workarounds None (apart from preventing physical access to the device) Resources https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a
Recommended action: Upgrade to 0.0.0-20230519072751-977f42b07fa9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20220708121648-5fef4d92e758
Fixed in
0.0.0-20220708121648-5fef4d92e758· Vendor fix available
Issue
Impact On boot, Pillar checks for /config/GlobalConfig/global.json and overrides system configuration if present. This allows enabling debug functions like SSH (debug.enable.ssh), USB keyboard (debug.enable.usb), and VNC access (app.allow.vnc) without triggering the measured boot. Thus, a user with physical access can take out the disk and modify the content of this file in the /config partition and then re-insert the disk. Patches Fixed in 10.1.0 and 9.4.3-lts Workarounds None
Recommended action: Upgrade to 0.0.0-20220708121648-5fef4d92e758 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20230519072751-977f42b07fa9
Fixed in
0.0.0-20230519072751-977f42b07fa9· Vendor fix available
Issue
Impact VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service. An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service. Patches Fixed in 9.4.3-lts and 10.1.0 Workarounds None
Recommended action: Upgrade to 0.0.0-20230519072751-977f42b07fa9 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20220708121648-5fef4d92e758
Fixed in
0.0.0-20220708121648-5fef4d92e758· Vendor fix available
Issue
Impact On boot, the Pillar container checks for /config/authorizedkeys. If present with a valid public key, it enables SSH on port 22 with root login. The /config partition is not protected by measured boot, is mutable and unencrypted. This enables an attacker with physical access to the device to take out the disk, modify the /config partition using a separate server, then insert it, without the inserted key being flagged as an integrity voilation my measured boot and remote attestation. Patches Patched in 9.4.3-lts Workarounds None (apart from preventing physical access to the device)
Recommended action: Upgrade to 0.0.0-20220708121648-5fef4d92e758 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/lf-edge/eve < 0.0.0-20230126065759-d9383a7ee4e1
Fixed in
0.0.0-20230126065759-d9383a7ee4e1· Vendor fix available
Issue
Impact PCR14 is not included in the list of PCRs that seal/unseal the vault key. Additionally, the vault key uses SHA1 PCRs instead of SHA256. Thus an attacker with physical access can take out the disk, use a different computer to modify the files in the /config partition, and re-insert the disk and boot without the change being detected by measured boot and remote attestation. Patches Fixed in EVE version 9.4.3-lts Workarounds None (apart from preventing physical access to the device) Resources https://help.zededa.com/hc/en-us/articles/43295940828827-TPM-PCR-Index-Security-Implications https://github.com/lf-edge/eve/commit/d9383a7ee4e1c39f5c8c6d4a63cb2ebd00695e8a
Recommended action: Upgrade to 0.0.0-20230126065759-d9383a7ee4e1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.