CVE-2022-1053 Tenant and Verifier might not use the same registrar data

What is CVE-2022-1053?

CVE-2022-1053 is a critical vulnerability in Fedoraproject Fedora, published on 6 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,

Weakness: CWE-20

Which versions are affected by CVE-2022-1053?

3 open source packages ship an affected version, including keylime. It affects 2 products.

Products include Fedoraproject Fedora, Keylime Keylime.

How do I fix CVE-2022-1053?

Upgrade keylime to 6.4.0 or later.

Is CVE-2022-1053 being exploited?

There is no known exploitation of CVE-2022-1053 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2024-4577 PHP-CGI OS Command Injection Exploited Critical 9.8
• CVE-2021-39226 Grafana Authentication Bypass Exploited Critical 9.8
• CVE-2019-5544 VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Exploited Critical 9.8
• CVE-2024-4947 Google Chromium V8 Type Confusion Exploited Critical 9.6
• CVE-2024-4671 Google Chromium Visuals Use-After-Free Exploited Critical 9.6

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-jf66-3q76-h5p5, GHSA-jf66-3q76-h5p5,, PYSEC-2022-184, openSUSE-SU-2024:12104-1.