CVE-2022-31250 keylime %post scriplet allows for privilege escalation from keylime user to root

A UNIX Symbolic Link Symlink Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1...

CVE-2022-31250

CVE-2022-31250 affects openSUSE Tumbleweed keylime prior to 6.4.2-1.1, describing a UNIX Symlink Following vulnerability in the post-install/scriptlet that allows local privilege escalation from the keylime user to root. Affected product/version: keylime on openSUSE Tumbleweed (prior to 6.4.2-1.1...

openSUSE Tumbleweed 后置链接漏洞

openSUSE Tumbleweed is an open source system from the openSUSE project. A security vulnerability exists in openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1, which stems from the presence of a UNIX Symbolic Link Following vulnerability that could allow a local attacker to upgrade from the...

PT-2022-20639 · Keylime +1 · Keylime +1

Name of the Vulnerable Software and Affected Versions: keylime versions prior to 6.4.2-1.1 Description: A UNIX Symbolic Link Symlink Following issue in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. Recommendations: For versions prior to 6.4.2-1.1...

CVE-2022-31250

A UNIX Symbolic Link Symlink Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1...

Fedora: Security Advisory for keylime (FEDORA-2022-f9ace23a78)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for keylime (FEDORA-2022-7c9173843a)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: keylime-6.4.0-1.fc34

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

[SECURITY] Fedora 35 Update: keylime-6.4.0-1.fc35

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

Fedora: Security Advisory for keylime (FEDORA-2022-748fda10e7)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: keylime-6.4.0-1.fc36

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

CVE-2022-1053

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

PYSEC-2022-184

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

PYSEC-2022-184

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

Input validation

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

CVE-2022-1053

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

CVE-2022-1053

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

CVE-2022-1053

Keylime vulnerability CVE-2022-1053: the tenant and verifier could use mismatched registrar data during EK/identity quote validation, allowing an AK/EK pair from a real TPM to pass EK validation and fool the verifier by presenting an AK from a software TPM. This undermines the integrity of the ch...

Validation Bypass

keylime is vulnerable to validation bypass. The vulnerability is caused due to lack of enforcement of same registrar data for tenant and verifier validation of the EK, AK and identity and integrity quotes, allowing to break the chain of trust as it can use invalid AK as valid...

Keylime 输入验证错误漏洞

Keylime is an open source extensible trust system for Keylime that utilizes TPM technology. A security vulnerability exists in Keylime. An attacker exploiting this vulnerability could cause the application to crash...