GHSA-6jp5-grgh-jw42

EVE Freely Allocates Buffer on The Stack With Data From Socket

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-43632

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/lf-edge/eve	< 0.0.0-20230519072751-977f42b07fa9	0.0.0-20230519072751-977f42b07fa9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service. An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service. ### Patches Fixed in 9.4.3-lts and 10.1.0 ### Workarounds None

References

External links from the advisory. They lead to third-party sites.

https://github.com/lf-edge/eve/security/advisories/GHSA-6jp5-grgh-jw42 web
https://nvd.nist.gov/vuln/detail/CVE-2023-43632 advisory
https://asrg.io/security-advisories/cve-2023-43632 web
https://asrg.io/security-advisories/freely-allocate-buffer-on-the-stack-with-data-from-socket web
https://github.com/lf-edge/eve package