CVEvulnerability
CVE-2025-13609
8.2 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2025-11-24
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
- Weaknesses
- CWE-694
Description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Related
Weakness · CWE (1)
- CWE-694 Use of Multiple Resources with Duplicate Identifier weakness
References
- https://access.redhat.com/errata/RHSA-2025:23201 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:23210 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:23628 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:23735 access.redhat.com
- https://access.redhat.com/errata/RHSA-2025:23852 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:0429 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2025-13609 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2416761 bugzilla.redhat.com
- https://github.com/keylime/keylime/issues/1820 github.com