Measured boot validates BIOS, grub, kernel cmdline, and initrd but not the entire rootfs. Thus, an attacker can create an EVE-OS rootfs squashfs image with some files modified and take out the disk and replace the existing rootfs image without that being detected by measure boot and remote attestation.
Fixed in 8.6.0 and 8.12.1-lts
None
0.0.0-20220708121648-5fef4d92e758Exploitability
AV:PAC:HPR:LUI:NScope
S:CImpact
C:HI:HA:N6.7/CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N