CVE-2023-3674
Keylime: attestation failure when the quote's signature does not validate
CVSS Score
2.3
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
| CWE | CWE-1283 |
| Vendor | red hat |
| Product | red hat enterprise linux 9 |
| Published | Jul 19, 2023 |
| Last Updated | Nov 21, 2025 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat enterprise linux 9
Be the first to know when new low vulnerabilities affecting red hat red hat enterprise linux 9 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
Red Hat / Red Hat Enterprise Linux 9
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2024:1139 access.redhat.com: https://access.redhat.com/security/cve/CVE-2023-3674 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2222903 github.com: https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
Credits
Red Hat would like to thank Stefan Berger (IBM) for reporting this issue.