CVE-2025-13609: Keylime: keylime: registrar allows identity takeover via duplicate uuid registration

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-24 · updated 2026-10-18
Weakness: CWE-694

Description

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

Affected products

Keylime Project keylime: before 7.14.0 — fixed in 7.14.0
Red Hat Enterprise Linux 10: all versions — fixed in 0:7.12.1-11.el10_1.3
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:7.12.1-2.el10_0.4
Red Hat Enterprise Linux 9: all versions — fixed in 0:7.12.1-11.el9_7.3
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 0:6.5.2-6.el9_2.1
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 0:7.3.0-13.el9_4.1
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 0:7.3.0-15.el9_6.1

How to fix

Upgrade to a fixed version: Keylime Project keylime 7.14.0; Red Hat Enterprise Linux 10 0:7.12.1-11.el10_1.3; Red Hat Enterprise Linux 10.0 Extended Update Support 0:7.12.1-2.el10_0.4; Red Hat Enterprise Linux 9 0:7.12.1-11.el9_7.3; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:6.5.2-6.el9_2.1; Red Hat Enterprise Linux 9.4 Extended Update Support 0:7.3.0-13.el9_4.1; Red Hat Enterprise Linux 9.6 Extended Update Support 0:7.3.0-15.el9_6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-13609 or the next vulnerability affects your stack