CVE-2023-43630
Crypto Weakness in Linuxfoundation Edge Virtualization Engine 9.0.0 – 9.5.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2023-43630 is a high-severity Use of Weak Hash (CWE-328) vulnerability in Linuxfoundation Edge Virtualization Engine. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48030
Vulnerability Data
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured…
more
correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 9 hardening rules · 6 OS baselines
V11.2.3V6.5.2V11.3.3
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Tracking information locations and access supports secure storage practices instead of insecure ones.
Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.
Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.
Secure-SDLC requirements explicitly forbid weak cryptographic algorithms, fully preventing CWE-328 while covering only one aspect of development practice.
Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.
Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.
Enforces least-privilege permissions and authorization reviews that limit read/write access to stored sensitive data.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.
Mandates use of approved cryptographic algorithms, directly preventing weak-hash selection.
Security testing can detect weak-hash usage but does not prescribe algorithm choice.
Forbidding clear-text transmission and display of passwords, plus the use of stronger alternatives to passwords, prevents credentials from being obtained or reused by attackers.
Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.
Contractual clauses that survive termination help ensure that credentials and other secrets are not retained or misused after employment ends.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows 10 (1 rule)
- V-220937 The system must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-328
Windows 11 (1 rule)
- V-253461 The system must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-328
Windows Server 2016 (3 rules)
- V-225053 Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-328
- V-224973 The Active Directory Domain Controllers Organizational Unit (OU) object must have the proper access control permissions. prevents CWE-922
- V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-922
Windows Server 2019 (2 rules)
- V-205654 Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-328
- V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-922
Windows Server 2022 (1 rule)
- V-254474 Windows Server 2022 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-328