CVE-2025-13609

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

• keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

• keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

• keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

• keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-13609: enforce TPM identity immutability for agent UUIDs in registrar, add shared memory for multiprocess synchronization

These are all security issues fixed in the keylime-config-7.13.0+40-1.1 package on the GA media of openSUSE Tumbleweed.

This update for keylime fixes the following issues:

Update to version 7.13.0+40.

Security issues fixed:

• CVE-2025-13609: possible agent identity takeover due to registrar allowing the registration of agents with duplicate UUIDs (bsc#1254199).
• CVE-2025-1057: registrar denial-of-service due to backward incompatibility in database type handling (bsc#1237153).

Other issues fixed and changes:

• Version 7.13.0+40:

  • Include new attestation information fields (#1818)
  • Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  • push-model: require HTTPS for authentication and attestation endpoints
  • Fix operational_state tracking in push mode attestations
  • templates: add push model authentication config options to 2.5 templates
  • Security: Hash authentication tokens in logs
  • Fix stale IMA policy cache in verification
  • Fix authentication behavior on failed attestations for push mode
  • Add shared memory infrastructure for multiprocess communication
  • Add agent authentication (challenge/response) protocol for push mode
  • Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  • docs: Fix man page RST formatting for rst2man compatibility (#1813)
  • Apply limit on keylime-policy workers
  • tpm: fix ECC signature parsing to support variable-length coordinates
  • tpm: fix ECC P-521 credential activation with consistent marshaling
  • tpm: fix ECC P-521 coordinate validation
  • Remove deprecated disabled_signing_algorithms configuration option (#1804)
  • algorithms: add support for specific RSA algorithms
  • algorithms: add support for specific ECC curve algorithms
  • Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  • Manpage for keylime agent
  • Manpage for keylime verifier
  • Manpage for keylime registrar
  • Use constants for timeout and max retries defaults
  • verifier: Use timeout from request_timeout config option
  • revocation_notifier: Use timeout setting from config file
  • tenant: Set timeout when getting version from agent
  • verify/evidence: SEV-SNP evidence type/verifier
  • verify/evidence: Add evidence type to request JSON

• Version v7.13.0:

  • Avoid re-encoding certificate stored in DB
  • Revert "models: Do not re-encode certificate stored in DB"
  • Revert "registrar_agent: Use pyasn1 to parse PEM"
  • policy/sign: use print() when writing to /dev/stdout
  • registrar_agent: Use pyasn1 to parse PEM
  • models: Do not re-encode certificate stored in DB
  • mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  • mb: support vendor_db as logged by newer shim versions
  • mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  • Remove unnecessary configuration values
  • cloud_verifier_tornado: handle exception in notify_error()
  • requests_client: close the session at the end of the resource manager
  • Manpage for keylime_tenant (#1786)
  • Add 2.5 templates including Push Model changes
  • Initial version of verify evidence API
  • db: Do not read pool size and max overflow for sqlite
  • Use context managers to close DB sessions
  • revocations: Try to send notifications on shutdown
  • verifier: Gracefully shutdown on signal
  • Use fork as multiprocessing start method
  • Fix inaccuracy in threat model and add reference to SBAT
  • Explain TPM properties and expand vTPM discussion
  • Fix invalid RST and update TOC
  • Expand threat model page to include adversarial model
  • Add --push-model option to avoid requests to agents
  • templates: duplicate str_to_version() in the adjust script
  • policy: fix mypy issues with rpm_repo
  • revocation_notifier: fix mypy issue by replacing deprecated call
  • Fix create_runtime_policy in python < 3.12
  • Fix after review
  • fixed CONSTANT names C0103 errors
  • Extend meta_data field in verifierdb
  • docs: update issue templates
  • docs: add GitHub PR template with documentation reminders
  • tpm_util: fix quote signature…

This update for keylime fixes the following issues:

Update to version 7.13.0+40.

Security issues fixed:

• CVE-2025-13609: possible agent identity takeover due to registrar allowing the registration of agents with duplicate UUIDs (bsc#1254199).
• CVE-2025-1057: registrar denial-of-service due to backward incompatibility in database type handling (bsc#1237153).

Other issues fixed and changes:

• Version 7.13.0+40:

  • Include new attestation information fields (#1818)
  • Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  • push-model: require HTTPS for authentication and attestation endpoints
  • Fix operational_state tracking in push mode attestations
  • templates: add push model authentication config options to 2.5 templates
  • Security: Hash authentication tokens in logs
  • Fix stale IMA policy cache in verification
  • Fix authentication behavior on failed attestations for push mode
  • Add shared memory infrastructure for multiprocess communication
  • Add agent authentication (challenge/response) protocol for push mode
  • Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  • docs: Fix man page RST formatting for rst2man compatibility (#1813)
  • Apply limit on keylime-policy workers
  • tpm: fix ECC signature parsing to support variable-length coordinates
  • tpm: fix ECC P-521 credential activation with consistent marshaling
  • tpm: fix ECC P-521 coordinate validation
  • Remove deprecated disabled_signing_algorithms configuration option (#1804)
  • algorithms: add support for specific RSA algorithms
  • algorithms: add support for specific ECC curve algorithms
  • Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  • Manpage for keylime agent
  • Manpage for keylime verifier
  • Manpage for keylime registrar
  • Use constants for timeout and max retries defaults
  • verifier: Use timeout from request_timeout config option
  • revocation_notifier: Use timeout setting from config file
  • tenant: Set timeout when getting version from agent
  • verify/evidence: SEV-SNP evidence type/verifier
  • verify/evidence: Add evidence type to request JSON

• Version v7.13.0:

  • Avoid re-encoding certificate stored in DB
  • Revert "models: Do not re-encode certificate stored in DB"
  • Revert "registrar_agent: Use pyasn1 to parse PEM"
  • policy/sign: use print() when writing to /dev/stdout
  • registrar_agent: Use pyasn1 to parse PEM
  • models: Do not re-encode certificate stored in DB
  • mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  • mb: support vendor_db as logged by newer shim versions
  • mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  • Remove unnecessary configuration values
  • cloud_verifier_tornado: handle exception in notify_error()
  • requests_client: close the session at the end of the resource manager
  • Manpage for keylime_tenant (#1786)
  • Add 2.5 templates including Push Model changes
  • Initial version of verify evidence API
  • db: Do not read pool size and max overflow for sqlite
  • Use context managers to close DB sessions
  • revocations: Try to send notifications on shutdown
  • verifier: Gracefully shutdown on signal
  • Use fork as multiprocessing start method
  • Fix inaccuracy in threat model and add reference to SBAT
  • Explain TPM properties and expand vTPM discussion
  • Fix invalid RST and update TOC
  • Expand threat model page to include adversarial model
  • Add --push-model option to avoid requests to agents
  • templates: duplicate str_to_version() in the adjust script
  • policy: fix mypy issues with rpm_repo
  • revocation_notifier: fix mypy issue by replacing deprecated call
  • Fix create_runtime_policy in python < 3.12
  • Fix after review
  • fixed CONSTANT names C0103 errors
  • Extend meta_data field in verifierdb
  • docs: update issue templates
  • docs: add GitHub PR template with documentation reminders
  • tpm_util: fix quote signature…

This update for keylime fixes the following issues:

• CVE-2025-13609: avoid re-registration of clients with same UUID but with different TPM identity (bsc#1254199).