CVE-2023-3674

LOW EPSS 10.4%
Published Jul 19, 20232y ago · Modified Jun 17, 20262w ago
2.8 CVSS 3.1
Low
Find Similar
Published Jul 19, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

CVSS Details

Base Score
2.8
Exploitability
1.3
Impact
1.4
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
10.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-1283

Affected Products 2

VendorProductVersionRange
keylimekeylime* <7.2.5
fedoraprojectfedora38any

References 4

  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:1139
  • access.redhat.com https://access.redhat.com/security/cve/CVE-2023-3674
    Third Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2222903
    Issue TrackingPatchThird Party Advisory
  • github.com https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
    Patch

Remediation

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2222903
    Issue TrackingPatchThird Party Advisory
  • github.com https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db
    Patch