PyPi: Keylime

CVE-2022-3500

Safety vulnerability ID: 54579

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Nov 22, 2022 Updated at Feb 14, 2025
Scan your Python projects for vulnerabilities →

Advisory

### Impact

This vulnerability creates a false sense of security for keylime users -- i.e. a user could query keylime and conclude that a parcitular node/agent is correctly attested, while attestations are not in fact taking place.

**Short explanation**: the keylime verifier creates periodic reports on the state of each attested agent. The keylime verifier runs a set of python asynchronous processes to challenge attested nodes and create reports on the outcome.

The vulnerability consists of the above named python asynchronous processes failing silently, i.e. quitting without leaving behind a database entry, raising an error or producing even a mention of an error in a log. The silent failure can be triggered by a small set of transient network failure conditions; recoverable device driver crashes being one such condition we saw in the wild.

### Patches

The problem is fixed in keylime starting with tag 6.5.1

### Workarounds

This [patch](https://github.com/keylime/keylime/pull/1128/files) can be retroactively applied to any running keylime deployment.
Only running verifiers need to be patched.
After the patch is applied, the keylime verifier needs to be restarted.

### References

The problem, as well as the proposed fix, are described in detail [here](https://github.com/keylime/keylime/pull/1128).
Further details about the system where the bug was found, and the conditions in which the bug was found, are available from @galmasi on demand.

### For more information

If you have any questions or comments about this [advisory](https://github.com/keylime/keylime/security/advisories/GHSA-hff2-x2j9-gxgv), please comment at the bottom of the advisory itself.

Affected package

keylime

Latest version: 7.12.1

TPM-based key bootstrapping and system integrity measurement system for cloud

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

MEDIUM 5.1

CVSS v3 Details

MEDIUM 5.1
Attack Vector (AV)
LOCAL
Attack Complexity (AC)
HIGH
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH