Moderate: keylime security update

2023-09-1200:00:00

Google

osv.dev

keylime

tpm

remote boot attestation

runtime integrity

security update

cve-2023-38200

cve-2023-38201

registrar

challenge-response protocol

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

52.9%

JSON

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

keylime: registrar is subject to a DoS against SSL connections (CVE-2023-38200)
Keylime: challenge-response protocol bypass during agent registration (CVE-2023-38201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.