CVE-2023-43634

Summary

CVE-2023-43634 is a vulnerability in a system's key sealing and unsealing process. The issue lies in a change made in commit "56e589749c6ff58ded862d39535d43253b249acf" where the measurement of the config partition was moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of PCRs used for key sealing and unsealing. As a result, this measurement is rendered redundant and an attacker could modify the config partition without triggering the measured boot, potentially gaining full control over the device and access to the encrypted "vault" contents. Previously, the config partition was protected by a measurement in PCR 13, but this protection was inadvertently removed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.