VYPR
← All advisories
High severityNVD Advisory· Published Aug 25, 2023· Updated Nov 20, 2025

Keylime: challenge-response protocol bypass during agent registration

CVE-2023-38201

Description

A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Keylime registrar vulnerability allows challenge-response bypass during agent registration, enabling impersonation and integrity breach.

Vulnerability

Details

CVE-2023-38201 is a flaw in the Keylime registrar component that allows an attacker to bypass the challenge-response protocol during agent registration [1][2]. This bypass can be used to impersonate a legitimate agent, potentially hiding the true integrity status of a monitored machine [2].

Exploitation

Prerequisites

Exploitation requires network access to the registrar service. The attacker can register a fake agent, and if that agent is added to the verifier's list by a legitimate user, the attacker can disguise the actual state of the target machine [2]. Keylime consists of a verifier, registrar, and agent; the registrar acts as a database for agent public keys [3].

Impact

Successful exploitation leads to a breach of the registrar database integrity, allowing an attacker to hide the actual trust status of a remote machine [1][2]. This undermines the attestation process and could allow compromised machines to evade detection.

Mitigation

The vulnerability is fixed in Keylime version 6.5.2-6.el9_2 as part of Red Hat Security Advisory RHSA-2023:5080 [1]. Users should update to this patched version or later to mitigate the risk.

References
  1. https://access.redhat.com/errata/RHSA-2023:5080
  2. cve-details
  3. GitHub - keylime/keylime: A CNCF Project to Bootstrap & Maintain Trust on the Edge / Cloud and IoT

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
keylimePyPI
< 7.5.07.5.0

Affected products

13

Patches

1
9e5ac9f25cd4

Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)

https://github.com/keylime/keylimeMarcio SilvaJul 12, 2023via ghsa
commit
1 file changed · +13 −2
  • keylime/registrar_common.py+13 −2 modified
    @@ -250,7 +250,9 @@ def get_network_params(
             try:
                 port = int(port)
                 if port < 1 or port > 65535:
-                    logger.warning("Contact port for agent %s is not a number between 1 and got: %s.", agent_id, port)
+                    logger.warning(
+                        "Contact port for agent %s is not a number between 1 and 65535 got: %s.", agent_id, port
+                    )
                     port = None
             except ValueError:
                 logger.warning("Contact port for agent %s is not a valid number got: %s.", agent_id, port)
@@ -447,7 +449,16 @@ def do_PUT(self) -> None:
                     logger.error("SQLAlchemy Error: %s", e)
                     raise
             else:
-                raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")
+                if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
+                    try:
+                        session.commit()
+                    except SQLAlchemyError as e:
+                        logger.error("SQLAlchemy Error: %s", e)
+                        raise
+
+                raise Exception(
+                    f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
+                )
 
             web_util.echo_json_response(self, 200, "Success")
             logger.info("PUT activated: %s", agent_id)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.