CVE-2022-23948

Advisory

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607
• https://seclists.org/oss-sec/2022/q1/101
• https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724
• https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52
• https://nvd.nist.gov/vuln/detail/CVE-2022-23948
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23948