PT-2026-6369 · Go · Github.Com/Lf-Edge/Eve/Pkg/Grub

Published 2026-02-04 · Updated 2026-02-04

OSV

CVSS v3.1

6.7

Medium

Base vector

AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Impact

Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.

Patches

Fixed in 8.6.0 and 8.12.1-lts

Workarounds

None

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

GHSA-5H7V-G49C-H887

Affected Products

Github.Com/Lf-Edge/Eve/Pkg/Grub

References · 8

• https://osv.dev/vulnerability/GHSA-5h7v-g49c-h887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43636 · Security Note
• https://github.com/lf-edge/eve/commit/5fef4d92e75838cc78010edaed5247dfbdae1889 · Note
• https://github.com/lf-edge/eve/security/advisories/GHSA-5h7v-g49c-h887 · Note
• https://github.com/lf-edge/eve/commit/aa3501d6c57206ced222c33aea15a9169d629141 · Note
• https://github.com/lf-edge/eve · Note
• https://asrg.io/security-advisories/cve-2023-43636 · Note
• https://asrg.io/security-advisories/19274 · Note