Summary
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.
Security Fix(es):
* keylime: registrar is subject to a DoS against SSL connections (CVE-2023-38200)
* Keylime: challenge-response protocol bypass during agent registration (CVE-2023-38201)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | keylime | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | keylime-base | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | keylime-registrar | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | keylime-selinux | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | keylime-tenant | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | keylime-verifier | 6.5.2-6.el9_2.alma.1 |
| AlmaLinux · 9 | python3-keylime | 6.5.2-6.el9_2.alma.1 |
Vulnerabilities 2
-
High 7.5
Keylime: registrar is subject to a dos against ssl connections
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
-
Medium 6.5
Keylime: challenge-response protocol bypass during agent registration
A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is add…