CVE-2023-43634
CVSS 3.1 Score 8.8 of 10 (high)
Details
Summary
CVE-2023-43634 is a vulnerability that affects multiple products (identified by the product codes) and has a high severity rating of 8.8 out of 10. The vulnerability arises from a misconfiguration in the sealing/unsealing process of the "vault" key, specifically related to the measurement of PCR values. The issue occurs when the config partition measurement is moved from PCR 13 to PCR 14, but PCR 14 is not added to the list of PCRs that seal/unseal the key. This makes the measurement of PCR 14 redundant and allows an attacker to modify the config partition without triggering measured boot, potentially gaining full control over the device and accessing encrypted data stored in the "vault." It is recommended to remediate this vulnerability by updating the affected products to include PCR 14 in the list of PCRs used for sealing/unsealing operations.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions