GHSA-6jp5-grgh-jw42 — medium GitHub Advisory (CVE-2023-43632) in go/github.com/lf-edge/eve

Description

Impact

VTPM server listens on port 8877, exposing limited TPM functionality. The server reads 4 bytes as a uint32 size header, then allocates that amount on the stack for incoming data. This allows Denial of Service attacks against the vTPM service.

An workload (a container or VM) running on EVE-OS can use this to generate a DOS against the vTPM service.

Patches

Fixed in 9.4.3-lts and 10.1.0

Workarounds

None

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2026-02-04 20:47:37 UTC
Updated: 2026-02-04 20:47:38 UTC
GitHub reviewed: 2026-02-04 20:47:37 UTC

Score	Percentile
0.07%	21.79%

CVSS Scores

Base score	Version	Severity	Vector
6.5	3.1	—	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:N) Doesn’t really leak secrets in a meaningful way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.

Identifiers

Type	Value
GHSA	GHSA-6jp5-grgh-jw42 ↗
CVE	CVE-2023-43632 ↗

CWEs

CWE id	Name
CWE-770	Allocation of Resources Without Limits or Throttling
CWE-789	Memory Allocation with Excessive Size Value

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/lf-edge/eve	< 0.0.0-20230519072751-977f42b07fa9	0.0.0-20230519072751-977f42b07fa9	—

EVE Freely Allocates Buffer on The Stack With Data From Socket