A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
CVSS Details
- CVSS 3.1 Base Score: 2.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylimeUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylime-selinuxUpgrade keylime-registrarUpgrade keylime-tenantUpgrade keylime-verifier | Mar 8, 2024 | Jul 19, 2023 |
| Oracle_linux | — | Upgrade keylime-tenantUpgrade keylime-baseUpgrade keylimeUpgrade keylime-selinuxUpgrade keylime-registrarUpgrade python3-keylimeUpgrade keylime-verifier | Mar 6, 2024 | Jul 12, 2023 |
| Redhat_linux | — | Upgrade keylime-registrarUpgrade keylimeUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylime-selinuxUpgrade keylime-tenantUpgrade python3-keylime | Mar 6, 2024 | Jul 19, 2023 |
| Rocky_linux | — | Upgrade python3-keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-tenantUpgrade keylime | May 13, 2024 | Jul 19, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub