Skip to content

Product

linuxfoundation edge virtualization engine vulnerabilities

3 published CVES affecting linuxfoundation edge virtualization engine, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
3
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest linuxfoundation edge virtualization engine CVEs

Newest publication first

  1. CVE-2023-43637 Vault Key Partially Predetermined

    Published
    HighCVSS 7.8

    Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always return "foobarfoobarfo...

  2. CVE-2023-43631 SSH as Root Unlockable Without Triggering Measured Boot

    Published
    HighCVSS 8.8

    On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized keys for root login. An...

  3. CVE-2023-43635 Vault Key Sealed With SHA1 PCRs

    Published
    HighCVSS 8.8

    Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry. These PCRs are then used in order to seal/unsea...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.