CVE-2022-1053

keylime, fedoraproject fedora

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-1053

Katalog CVE

CVSS 9.1 · Critical EPSS 1,5%

Kerentanan Improper Input Validation pada keylime, fedoraproject fedora. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1,

Rincian

Terbit di NVD
6 Mei 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
EPSS (30 hari)
1,5% peluang dieksploitasi; lebih tinggi dari 73,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
keylime keylime Semua versi sebelum 6.4.0
fedoraproject fedora Versi 34
fedoraproject fedora Versi 35
fedoraproject fedora Versi 36

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.