CVE-2022-1053: Keylime Agent Registrar Data Validation Bypass
Summary
CVE-2022-1053: Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. Affects keylime across 2 version ranges.
< 6.4.0
< bd5de712acdd77860e7dc58969181e16c7a8dc5d
Fixed in bd5de712acdd77860e7dc58969181e16c7a8dc5d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is an open-source project that provides a trusted cloud infrastructure for secure boot and remote attestation. It utilizes the Trusted Platform Module (TPM) technology to establish a chain of trust between the hardware and software components in a cloud environment. Keylime includes an agent registrar component that manages the registration and validation of agents in the system. This vulnerability affects the agent registrar's data validation process, potentially allowing an attacker to bypass the integrity check and compromise the chain of trust.
Vulnerability Detail
The vulnerability in Keylime arises from the lack of enforcement in validating the agent registrar data consistency. Specifically, the validation of the Endorsement Key (EK) and identity quote by the tenant does not match the verifier's validation of the integrity quote. This discrepancy enables an attacker to use a genuine TPM's AK and EK pair to pass the EK validation, while providing the verifier with a software TPM's AK. By exploiting this vulnerability, an attacker can introduce an unvalidated AK into the chain of trust, compromising its integrity. The impact is particularly severe if the validation occurs before the agent is added to the verifier, as the timing is more favorable for the attacker and the verifier does not verify the regcount entry's equality to 1.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
bd5de712acdd77860e7dc58969181e16c7a8dc5d
This is the first release that contains the fix.
pip install --upgrade "keylime==bd5de712acdd77860e7dc58969181e16c7a8dc5d"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Keylime package to the latest version.
Conclusion
The vulnerability in Keylime's agent registrar data validation process can allow an attacker to bypass the integrity check and compromise the chain of trust. It is crucial to update the Keylime package to version 6.4.0 or later to fix this vulnerability. No known workarounds exist, and it is recommended to apply the update promptly. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for keylime →
FAQ
Keylime is an open-source project that provides a trusted cloud infrastructure for secure boot and remote attestation. It utilizes the Trusted Platform Module (TPM) technology to establish a chain of trust between the hardware and software components in a cloud environment.
This vulnerability allows an attacker to bypass the integrity check in Keylime's agent registrar data validation process. By introducing an unvalidated Attestation Key (AK) into the chain of trust, the entire trust chain can be compromised, potentially leading to unauthorized access and tampering of the system.
To fix this vulnerability, it is recommended to update the Keylime package to version 6.4.0 or later. This update includes the necessary enforcement of agent registrar data consistency, ensuring that the EK and identity quote validation matches the integrity quote validation.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the Keylime package to the latest version.
For more information about this vulnerability, you can refer to the official advisory database entry: https://github.com/pypa/advisory-database/blob/main/vulns/keylime/PYSEC-2022-184.yaml
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
