CVE-2023-3674 Keylime: attestation failure when the quote's signature does not validate
Keylime fails to flag devices with invalid TPM quote signatures as untrusted, allowing bypass of attestation security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3674?
CVE-2023-3674 is a low-severity vulnerability in Fedoraproject Fedora, published on 19 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
Weakness: CWE-1283
Which versions are affected by CVE-2023-3674?
3 open source packages ship an affected version, including keylime. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
keylime PyPI | All versions | 7.2.5 |
keylime PyPI | All versions | 7.2.5 |
keylime PyPI | All versions | 7.2.5 |
Linux distribution packages (16)
keylime AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime-base AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime-registrar AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime-selinux AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime-tenant AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime-verifier AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
python3-keylime AlmaLinux:9 | All versions | 7.3.0-13.el9_3 |
keylime Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime-base Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime-registrar Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime-selinux Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime-tenant Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime-verifier Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
python3-keylime Red Hat:enterprise_linux:9::appstream | All versions | 0:7.3.0-13.el9_3 |
keylime Rocky Linux:9 | All versions | 0:7.3.0-13.el9_3 |
keylime openSUSE:Tumbleweed | All versions | 7.11.0-1.1 |
Products include Fedoraproject Fedora, Keylime Keylime.
How do I fix CVE-2023-3674?
Upgrade keylime to 7.2.5 or later.
Is CVE-2023-3674 being exploited?
There is no known exploitation of CVE-2023-3674 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALSA-2024:1139, GHSA-g4wg-cfpf-9689, PYSEC-2023-128, RHSA-2024:1139, RLSA-2024:1139, openSUSE-SU-2024:14051-1.