SB2024030553 - Red Hat Enterprise Linux 9 update for keylime
Published: March 5, 2024
Security Bulletin ID
SB2024030553
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Security features bypass (CVE-ID: CVE-2023-3674)
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to an error in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Remediation
Install update from vendor's website.