CVE-2025-13609
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in Keylime allows an attacker to register a new agent using a different TPM device but claiming an existing agent's UUID. This overwrites the legitimate agent's identity and enables impersonation.
Risk Assessment
An attacker can bypass security controls by impersonating a trusted agent, potentially compromising the integrity and confidentiality of systems managed by Keylime.
Recommendation
Immediately update Keylime to a patched version and implement mechanisms to verify the uniqueness of agent UUIDs during registration.
Other vulnerabilities in Keylime
See all- CVE-2026-1709Critical
A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.
- CVE-2025-1057Medium
In Keylime 7.12.0, strict type checking prevents the registrar from reading database entries created by older versions (e.g., 7.11.0). Older versions store agent registration data as bytes, while the updated registrar expects str. This causes an exception when processing agent registration requests, making the agent fail.
- CVE-2023-38200High
A flaw was found in Keylime that allows for a remote denial of service attack against its SSL connections. An attacker can exhaust all available connections.
Original NVD description (English source)
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.