Summary
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.
Security Fix(es):
* keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | keylime | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-base | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-registrar | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-selinux | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-tenant | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-tools | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | keylime-verifier | 7.14.1-5.el10_2.1 |
| AlmaLinux · 10 | python3-keylime | 7.14.1-5.el10_2.1 |
Vulnerabilities 1
-
Medium 6.3
Keylime: keylime: security bypass due to hardcoded tpm quote nonce
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quot…