PT-2026-6369 · Go · Github.Com/Lf-Edge/Eve/Pkg/Grub
Publicado
2026-02-04
·
Atualizado
2026-02-04
CVSS v3.1
6.7
Média
| Vetor | AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
Impact
Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.
Patches
Fixed in 8.6.0 and 8.12.1-lts
Workarounds
None
Correção
Insufficient Verification of Data Authenticity
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Github.Com/Lf-Edge/Eve/Pkg/Grub