CVE-2023-43630
Crypto Weakness in Linuxfoundation Edge Virtualization Engine 9.0.0 – 9.5.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-43630 is a high-severity Use of Weak Hash (CWE-328) vulnerability in Linuxfoundation Edge Virtualization Engine. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48030
Vulnerability Data
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured…
more
correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V11.2.3V6.5.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Tracking information locations and access supports secure storage practices instead of insecure ones.
Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper data-at-rest integrity protection requires strong cryptographic hashes, directly blocking weak-hash usage.
Data-in-transit integrity likewise depends on strong hashes, so the control prevents the weakness while the weakness only partially satisfies the outcome.
Secure-SDLC requirements explicitly forbid weak cryptographic algorithms, fully preventing CWE-328 while covering only one aspect of development practice.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.
A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).
A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522
Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220937 The system must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328
Windows Server 2016 (1 rule)
- V-225053 Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328
Windows Server 2019 (1 rule)
- V-205654 Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328