Keylime: keylime: registrar allows identity takeover via duplicate uuid registration (Keylime Project keylime)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.47 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Weaknesses (CWE)
- CWE-694 — Use of Multiple Resources with Duplicate Identifier
References
- https://access.redhat.com/errata/RHSA-2025:23201
- https://access.redhat.com/errata/RHSA-2025:23210
- https://access.redhat.com/errata/RHSA-2025:23628
- https://access.redhat.com/errata/RHSA-2025:23735
- https://access.redhat.com/errata/RHSA-2025:23852
- https://access.redhat.com/errata/RHSA-2026:0429
- https://access.redhat.com/security/cve/CVE-2025-13609
- https://bugzilla.redhat.com/show_bug.cgi?id=2416761
- https://github.com/keylime/keylime/issues/1820
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L | redhat |
| CVSS 3.1 | HIGH 8.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-xh5w-g8gq-r3v9 — Keylime allows users to register new agents by recycling existing UUIDs when using different TPM devices
- PYSEC-2025-77 — A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM
European references
- ENISA EUVD · EUVD-2025-198980
- GCVE · GCVE-0-2025-13609
Affected products
| Product | Versions |
|---|---|
| Keylime Project · keylime | affected 0 < 7.14.0 |
| Red Hat · Red Hat Enterprise Linux 10 | unaffected 0:7.12.1-11.el10_1.3 < * |
| Red Hat · Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 0:7.12.1-2.el10_0.4 < * |
| Red Hat · Red Hat Enterprise Linux 9 | unaffected 0:7.12.1-11.el9_7.3 < * |
| Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | unaffected 0:6.5.2-6.el9_2.1 < * |
| Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 0:7.3.0-13.el9_4.1 < * |
| Red Hat · Red Hat Enterprise Linux 9.6 Extended Update Support | unaffected 0:7.3.0-15.el9_6.1 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |