Security features bypass in keylime - CVE-2023-3674
Published: September 5, 2023
Vulnerability identifier: #VU80468
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-3674
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass implemented security restrictions.
The vulnerability exists due to an error in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Affected software
keylime
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
keylime (Red Hat package)
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
keylime (Red Hat package)
How to mitigate CVE-2023-3674
Install updates from vendor's website.
keylime - update to 7.4.0
keylime (Red Hat package) - update to 7.3.0-13.el9_3
keylime (Red Hat package) - update to 7.3.0-13.el9_3