Keylime vulnerabilities

A flaw was found in Keylime since version 7.12.0 where the registrar does not enforce client-side TLS authentication. Unauthenticated clients with network access can perform administrative operations, including listing agents, retrieving public TPM data, and deleting agents, without presenting a client certificate.

A vulnerability in Keylime allows an attacker to register a new agent using a different TPM device but claiming an existing agent's UUID. This overwrites the legitimate agent's identity and enables impersonation.

In Keylime 7.12.0, strict type checking prevents the registrar from reading database entries created by older versions (e.g., 7.11.0). Older versions store agent registration data as bytes, while the updated registrar expects str. This causes an exception when processing agent registration requests, making the agent fail.

A flaw was found in Keylime that allows for a remote denial of service attack against its SSL connections. An attacker can exhaust all available connections.