Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

Vulnerability

Overview

A flaw exists in the Keylime Registrar component, introduced in version 7.12.0, where client-side Transport Layer Security (TLS) authentication is not enforced. This authentication bypass vulnerability allows an unauthenticated client with network access to perform administrative operations, such as listing agents, retrieving public TPM data, and deleting agents, without presenting a valid client certificate [1][2].

Attack

Vector and Prerequisites

The attacker must have network connectivity to the Keylime Registrar service. No prior authentication or pre-existing trust relationship is required. The vulnerability stems from the registrar's failure to verify TLS client certificates during connection establishment, effectively disabling mutual TLS (mTLS) for the registrar's API endpoints [2][4].

Impact

A successful attacker can execute privileged operations including enumerating registered agents, extracting public TPM blobs, and removing agent entries from the registrar’s database. This compromises the trust model of the entire Keylime deployment, as the registrar acts as the central database for agent identities and TPM public keys [3][4].

Mitigation

Status

The vulnerability is classified as urgent severity by Red Hat and affects all Keylime deployments using the Registrar from version 7.12.0 onward. At the time of publication, a fix had not been released, and users are advised to restrict network access to the registrar as a workaround until a patched version is available [1][4].