CVE-2022-3500: Keylime - Unhandled Exceptions Could Lead to Invalid Attestation States
Summary
CVE-2022-3500: Keylime: unhandled exceptions could lead to invalid attestation states. Affects keylime versions < 6.5.1. Fixed in 6.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is an open-source project that provides a trusted cloud infrastructure for secure boot and remote attestation of bare-metal systems. It allows users to verify the integrity of their cloud instances and ensure that they have not been tampered with. Keylime achieves this by generating periodic reports on the state of each attested agent and running asynchronous processes to challenge attested nodes. These processes are responsible for creating reports on the outcome of the attestation. However, a vulnerability in Keylime allows these processes to fail silently, leading to a false sense of security for users. This vulnerability can be triggered by transient network failure conditions or device driver crashes.
Vulnerability Detail
The vulnerability in Keylime arises from the failure of the python asynchronous processes to handle exceptions properly. When these processes encounter certain network failure conditions or device driver crashes, they quit without leaving behind any trace of error, such as a database entry or a log entry. As a result, users querying Keylime may incorrectly conclude that a particular node or agent is correctly attested, while in reality, the attestations are not taking place. This vulnerability undermines the reliability and accuracy of the attestation process, potentially exposing users to security risks.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.5.1
This is the first release that contains the fix.
pip install --upgrade "keylime==6.5.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A temporary workaround for this vulnerability is available. Users can apply the provided patch to their running Keylime deployment. The patch can be found at the following location: Patch. Only running verifiers need to be patched. After applying the patch, the Keylime verifier needs to be restarted to ensure the changes take effect.
Conclusion
The vulnerability in Keylime that allows unhandled exceptions to lead to invalid attestation states has been identified and addressed in version 6.5.1. Users are advised to update their Keylime installation to the latest version to ensure the security and integrity of their attestation process. For further support or assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keylime →
FAQ
Keylime is an open-source project that provides a trusted cloud infrastructure for secure boot and remote attestation of bare-metal systems. It allows users to verify the integrity of their cloud instances and ensure that they have not been tampered with.
This vulnerability creates a false sense of security for Keylime users. Users may query Keylime and conclude that a particular node or agent is correctly attested, while in reality, the attestations are not taking place. This can lead to security risks and compromise the integrity of the attestation process.
To fix this vulnerability, users should update their Keylime installation to version 6.5.1 or later. This can be done by following the standard update procedure for the Keylime package.
Yes, a temporary workaround is available. Users can apply the provided patch to their running Keylime deployment. The patch can be found at the following location: https://github.com/keylime/keylime/pull/1128/files. After applying the patch, the Keylime verifier needs to be restarted.
More information about this vulnerability can be found in the advisory published by Keylime: https://github.com/keylime/keylime/security/advisories/GHSA-hff2-x2j9-gxgv
References
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
