Critical Identity Takeover Vulnerability in Keylime Package
Summary
ALSA-2025:23210: Important: keylime security update. Affects keylime versions < 7.12.1-11.el9_7.3. Fixed in 7.12.1-11.el9_7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is a Trusted Platform Module (TPM) based solution designed for scalable remote boot attestation and runtime integrity measurement. It ensures that systems boot securely and maintain their integrity throughout their operation. However, a significant vulnerability has been identified that allows for identity takeover through duplicate UUID registration, potentially compromising the security of systems relying on Keylime.
Vulnerability Detail
The vulnerability, identified as CVE-2025-13609, arises from the Keylime Registrar's failure to properly handle duplicate UUID registrations. This flaw allows an attacker to take over the identity of a legitimate user or system by registering a duplicate UUID, leading to unauthorized access and control over the affected systems. The ramifications of this vulnerability can be severe, including data breaches and loss of system integrity.
How To Fix
Minimum fixed version
7.12.1-11.el9_7.3
This is the first release that contains the fix.
sudo dnf update keylimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to monitor UUID registrations closely and implement strict access controls to prevent unauthorized registrations until the patch can be applied. Additionally, consider disabling the registration feature if it is not critical to your operations.
Conclusion
The Keylime package has a critical vulnerability that allows for identity takeover through duplicate UUID registration. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Users should also consider implementing temporary workarounds to enhance security until the update can be applied.
See every vulnerability recorded for keylime →
FAQ
CVE-2025-13609 is a vulnerability in the Keylime package that allows for identity takeover through duplicate UUID registration.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include potential unauthorized access to systems, data breaches, and loss of integrity for systems relying on Keylime.
You can apply the patch by updating the Keylime package to version 7.12.1-11.el9_7.3 using the command: sudo dnf update keylime keylime-base keylime-registrar keylime-selinux keylime-tenant keylime-verifier python3-keylime.
Yes, you can monitor UUID registrations and implement strict access controls as a temporary measure until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
