Keylime Identity Takeover Vulnerability in AlmaLinux Packages
Summary
ALSA-2025:23201: Important: keylime security update. Affects keylime versions < 7.12.1-11.el10_1.3. Fixed in 7.12.1-11.el10_1.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is a TPM-based solution designed for scalable remote boot attestation and runtime integrity measurement. It allows users to ensure that their systems are booting securely and that their runtime environments maintain integrity. However, a recent vulnerability has been identified that could allow an attacker to take over the identity of a registrar through duplicate UUID registration.
Vulnerability Detail
The vulnerability, identified as CVE-2025-13609, arises from the Keylime registrar's failure to properly handle duplicate UUID registrations. This flaw can lead to identity takeover, where an unauthorized user could impersonate a legitimate registrar, potentially compromising the security of the entire system. The ramifications of this vulnerability are significant, as it undermines the trust model that Keylime relies upon for secure operations.
How To Fix
Minimum fixed version
7.12.1-11.el10_1.3
This is the first release that contains the fix.
sudo dnf update keylimeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid registering duplicate UUIDs within the Keylime system to mitigate the risk of identity takeover until the update can be applied.
Conclusion
The Keylime vulnerability CVE-2025-13609 poses a serious risk of identity takeover through duplicate UUID registration. It is crucial for users to update their Keylime packages to the latest patched version to ensure the security of their systems. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for keylime →
FAQ
CVE-2025-13609 is a vulnerability in Keylime that allows for identity takeover through duplicate UUID registration.
If exploited, this vulnerability could allow an unauthorized user to impersonate a legitimate registrar, compromising the security of your system.
You should update your Keylime packages to version 7.12.1-11.el10_1.3 or later to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application's manifest file at Vulert's playground without any signup.
Failure to address this vulnerability could lead to unauthorized access and control over your Keylime registrar, potentially compromising the integrity of your entire system.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
