Vulnerability · Published Jul 19, 2023 · Assigned by redhat
CVE-2023-3674Keylime: attestation failure when the quote's signature does not validate
Low 2.3
In plain English
A low-severity security flaw in Red Hat Enterprise Linux 9 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.3Low
Exploit odds (30 days)0.2%top 88.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | keylime | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | keylime-base | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | keylime-registrar | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | keylime-selinux | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | keylime-tenant | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | keylime-verifier | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| AlmaLinux:9 | python3-keylime | 7.3.0-13.el9_3 | ALSA-2024:1139 |
| PyPI | keylime | 7.2.5 | GHSA-g4wg-cfpf-9689 |
| PyPI | keylime | 7.2.5 | PYSEC-2023-128 |
| Rocky Linux:9 | keylime | 0:7.3.0-13.el9_3 | RLSA-2024:1139 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-1283 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- RHSA-2024:1139 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-3674 vdb-entry, x_refsource_REDHAT
- RHBZ#2222903 issue-tracking, x_refsource_REDHAT
- https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db