What’s Vulnerable › Vulnerabilities

CVE-2023-3674: Keylime: attestation failure when the quote's signature does not validate

• Severity: low (CVSS 2.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-19 · updated 2026-06-17
• Weakness: CWE-1283

Description

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

Affected products

• Fedoraproject Fedora: 38
• keylime: before 7.2.5 — fixed in 7.2.5

How to fix

Upgrade to a fixed version: keylime 7.2.5. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:1139
• https://access.redhat.com/security/cve/CVE-2023-3674
• https://bugzilla.redhat.com/show_bug.cgi?id=2222903
• https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
• https://access.redhat.com/errata/RHSA-2024:1139
• https://access.redhat.com/security/cve/CVE-2023-3674
• https://bugzilla.redhat.com/show_bug.cgi?id=2222903
• https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db

Get alerted when CVE-2023-3674 or the next vulnerability affects your stack