A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade keylime-tenantUpgrade keylime-registrarUpgrade keylime-selinuxUpgrade keylimeUpgrade keylime-baseUpgrade keylime-verifierUpgrade python3-keylime | Dec 18, 2025 | Dec 15, 2025 |
| Oracle_linux | — | Upgrade keylime-toolsUpgrade python3-keylimeUpgrade keylimeUpgrade keylime-verifierUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-tenantUpgrade keylime-selinux | Dec 22, 2025 | Nov 24, 2025 |
| Redhat_linux | — | Upgrade keylime-verifierUpgrade keylime-toolsUpgrade keylime-registrarUpgrade keylimeUpgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-baseUpgrade keylime-selinux | Dec 17, 2025 | Nov 24, 2025 |
| Rocky_linux | — | Upgrade keylime-registrarUpgrade keylime-toolsUpgrade python3-keylimeUpgrade keylime-verifierUpgrade keylimeUpgrade keylime-baseUpgrade keylime-tenant | Feb 5, 2026 | Dec 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub