A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1139 advisory.

  - A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote     as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an     error in the log without flagging the device as untrusted. (CVE-2023-3674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1139 advisory.

  - A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote     as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an     error in the log without flagging the device as untrusted. (CVE-2023-3674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1139 advisory.

    [7.3.0-13]
    - Backport fix for CVE-2023-3674       Resolves: RHEL-21013

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1139 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: Attestation failure when the quote's signature does not validate (CVE-2023-3674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196967	Rocky Linux 9 : keylime (RLSA-2024:1139)	Nessus	Rocky Linux Local Security Checks	low
191685	AlmaLinux 9 : keylime (ALSA-2024:1139)	Nessus	Alma Linux Local Security Checks	low
191657	Oracle Linux 9 : keylime (ELSA-2024-1139)	Nessus	Oracle Linux Local Security Checks	low
191577	RHEL 9 : keylime (RHSA-2024:1139)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2023-3674

low

Tenable Plugins

low

low

low

low