PT-2026-6382 · Go · Github.Com/Lf-Edge/Eve

Publicado 2026-02-04 · Atualizado 2026-02-04

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Impact

VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service.

An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service.

Patches

Fixed in 9.4.3-lts and 10.1.0

Workarounds

None

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-789

CWE-770

Identificadores relacionados

GHSA-6JP5-GRGH-JW42

Produtos afetados

Github.Com/Lf-Edge/Eve

Referências · 6

• https://github.com/lf-edge/eve · Nota
• https://github.com/lf-edge/eve/security/advisories/GHSA-6jp5-grgh-jw42 · Nota
• https://asrg.io/security-advisories/freely-allocate-buffer-on-the-stack-with-data-from-socket · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43632 · Nota de Segurança
• https://asrg.io/security-advisories/cve-2023-43632 · Nota
• https://osv.dev/vulnerability/GHSA-6jp5-grgh-jw42 · Aviso do Fabricante