CVE-2023-3674

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3674
A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

2.3 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903 Issue Tracking Patch Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db Patch
https://access.redhat.com/errata/RHSA-2024:1139
https://access.redhat.com/security/cve/CVE-2023-3674 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222903 Issue Tracking Patch Third Party Advisory
https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
History

21 Nov 2024, 08:17

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2024:1139 - () https://access.redhat.com/errata/RHSA-2024:1139 -
References () https://access.redhat.com/security/cve/CVE-2023-3674 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-3674 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2222903 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2222903 - Issue Tracking, Patch, Third Party Advisory
References () https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db - Patch () https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db - Patch
CVSS v2 : unknown
v3 : 2.8 		v2 : unknown
v3 : 2.3

25 Apr 2024, 13:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:1139 -

28 Jul 2023, 14:18

Type Values Removed Values Added
CWE NVD-CWE-Other
First Time Fedoraproject fedora
Keylime
Fedoraproject
Keylime keylime
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 2.8
CPE cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:keylime:keylime:*:*:*:*:*:*:*:*
References (MISC) https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db - (MISC) https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733db - Patch
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2222903 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2222903 - Issue Tracking, Patch, Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-3674 - (MISC) https://access.redhat.com/security/cve/CVE-2023-3674 - Third Party Advisory

19 Jul 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-19 19:15

Updated : 2024-11-21 08:17

NVD link : CVE-2023-3674

Mitre link : CVE-2023-3674

CVE.ORG link : CVE-2023-3674

JSON object : View

Products Affected

fedoraproject

  • fedora

keylime

  • keylime
CWE
CWE-1283

Mutable Attestation or Measurement Reporting Data

NVD-CWE-Other