Summary
Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.
Security Fix(es):
* keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | keylime | 0:7.12.1-11.el9_7.3 |
Vulnerabilities 1
-
High 8.2
Keylime: keylime: registrar allows identity takeover via duplicate uuid registration
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legi…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2416761