CVE Feed

    Dashboard / CVE / CVE-2021-43310

    CVE-2021-43310

    A vulnerability in Keylime before 6.3.0 allows an attacker to craft a request to the agent that resets the U and V keys as if the agent were being re-added to a verifier. This could lead to a remote code execution.

    Published:Sep 21, 2022
    Last Modified:May 27, 2025
    EPS:Sep 21, 2022
    EPSS Score:0.02891
    CVSS Score:9.8

    Affected Products

    Vendor
    Keylime
    Product
    Keylime

    Exploits

    https://seclists.org/oss-sec/2022/q1/101https://seclists.org/oss-sec/2022/q1/101

    Related CVEs

    CVE-2026-1709 (CVSS 9.4) — A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transpo…
    CVE-2023-38201 (CVSS 6.5) — A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during …
    CVE-2023-38200 (CVSS 7.5) — A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial…
    CVE-2023-3674 (CVSS 2.3) — A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as fa…
    CVE-2022-3500 (CVSS 5.1) — A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperl…
    CVE-2022-23952 (CVSS 7.5) — In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive…
    CVE-2022-23951 (CVSS 5.5) — In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead…
    CVE-2022-23950 (CVSS 7.5) — In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unp…
    CVE-2022-23949 (CVSS 7.5) — In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the …
    CVE-2022-23948 (CVSS 7.5) — A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can b…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High