PT-2022-5285 · Keylime+4 · Keylime+4

Sergio Correia · Published 2022-10-27 · Updated 2025-04-29 · CVE-2022-3500

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions keylime versions prior to 6.5.1

Description The issue is related to improperly handled exceptions in keylime, which can be exploited to create errors on the verifier, stopping attestation attempts and leaving a host in an attested state without verification. This creates a false sense of security for keylime users, as they may conclude that a node or agent is correctly attested when attestations are not taking place. The vulnerability can be triggered by transient network failure conditions, such as recoverable device driver crashes.

Recommendations For versions prior to 6.5.1, apply the patch available at https://github.com/keylime/keylime/pull/1128/files to fix the issue. Only running verifiers need to be patched, and after applying the patch, the keylime verifier needs to be restarted.

Fix

Weakness Enumeration

CWE-248

Related Identifiers

ALSA-2022:8444

BDU:2022-06569

CVE-2022-3500

GHSA-HFF2-X2J9-GXGV

OPENSUSE-SU-2022_4204-1

PYSEC-2022-42995

RHSA-2022:8444

RHSA-2022_8444

RLSA-2022:8444

SUSE-SU-2022:4204-1

SUSE-SU-2022_4204-1

Affected Products

Almalinux

Red Hat

Rocky Linux

Suse

Keylime

References · 33

• https://github.com/keylime/keylime/pull/1128 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PUTHMDVFNGGVPCNPOGULMJAAFEP7MEXP · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4204-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:8444 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:8444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3500 · Security Note
• https://bdu.fstec.ru/vul/2022-06569 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-42995 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QX4XVCAUFGJ2I2NCTOKONTJGRJB2NBBT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQH5CJRX65QYMQN5WGUKKKE3IRJBWG5Z · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PUTHMDVFNGGVPCNPOGULMJAAFEP7MEXP · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hff2-x2j9-gxgv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3500 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-8444.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QX4XVCAUFGJ2I2NCTOKONTJGRJB2NBBT · Vendor Advisory