A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade keylime-verifierUpgrade keylime-toolsUpgrade keylime-registrarNo solution existsUpgrade keylime-tenantUpgrade keylime-baseUpgrade python3-keylimeUpgrade keylimeUpgrade keylime-selinux | Jun 25, 2026 | May 6, 2026 |
| Rocky_linux | — | Upgrade keylime-tenantUpgrade python3-keylimeUpgrade keylime-toolsUpgrade keylime-registrarUpgrade keylime-baseUpgrade keylime-verifierUpgrade keylime | Jun 29, 2026 | Jun 25, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub