{"id":"CVE-2026-6420","aliases":["ALSA-2026:28582","EUVD-2026-27657","GHSA-q8w6-w55c-ccv5","GHSA-wc6p-4gwj-jcr8","PYSEC-2026-2548","RHSA-2026:28582","RLSA-2026:28582","SUSE-SU-2026:22326-1","openSUSE-SU-2026:10779-1","openSUSE-SU-2026:21025-1"],"status":"published","title":"Keylime: keylime: security bypass due to hardcoded tpm quote nonce","description":"A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00121,"percentile":0.01918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1241","CWE-294","CWE-329","CWE-547"],"published":"2026-05-06T10:19:39Z","modified":"2026-11-05T21:55:40Z","fixes":[{"ecosystem":"PyPI","package":"keylime","fixed_in":["7.14.2"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-base","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-registrar","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-selinux","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-tenant","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-tools","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"keylime-verifier","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"python3-keylime","fixed_in":["7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-base","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-registrar","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-selinux","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-tenant","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-tools","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-verifier","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-keylime","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"keylime","fixed_in":["0:7.14.1-5.el10_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"keylime","fixed_in":["7.14.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"keylime","fixed_in":["7.14.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"keylime","fixed_in":["7.14.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"keylime","fixed_in":["7.14.2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.14.0"},{"last_affected":"7.14.1"},{"fixed":"7.14.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.14.0"},{"fixed":"7.14.2"}]}],"versions":["7.14.0","7.14.1"]},{"source":"osv","ecosystem":"PyPI","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.14.0"},{"fixed":"7.14.2"}]}],"versions":["7.14.0","7.14.1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-registrar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-tenant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"keylime-verifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.1-5.el10_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14.2-160000.1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:28582","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6420","tags":["vdb-entry","x_refsource_REDHAT","report","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458889","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/keylime/keylime/security/advisories/GHSA-q8w6-w55c-ccv5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6420","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q8w6-w55c-ccv5","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wc6p-4gwj-jcr8"},{"url":"https://bugzilla.redhat.com/2458889","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-28582.html","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6420.json","tags":["advisory"]},{"url":"https://github.com/keylime/keylime","tags":["package"]},{"url":"https://pypi.org/project/keylime","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28582.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6420","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:28582","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622326-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264265","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6420","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-6420","title":"Keylime: keylime: security bypass due to hardcoded tpm quote nonce","description":"A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"published","published":"2026-05-06T10:19:39.121Z","modified":"2026-11-05T21:55:40.613Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1241"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-27657","description":"A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"published","published":"2026-05-06T10:19:39Z","modified":"2026-11-05T21:55:40Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-05T23:02:19.769742Z"}],"ghsa":[{"id":"GHSA-q8w6-w55c-ccv5","title":"Keylime has a hardcoded attestation challenge nonce that allows replay attacks","description":"## CVE-2026-6420: Hardcoded attestation challenge nonce allows replay attacks\n\n### Impact\n\nThe `CertificationParameters.generate_challenge()` method in the push attestation protocol uses a hardcoded challenge nonce instead of generating a cryptographically random value. This removes the nonce-based replay protection from TPM quote attestation.\n\nAn attacker with root access on a monitored agent node can exploit this by stockpiling valid TPM quotes (using `tpm2_quote` with the known nonce) before compromising the system, then replaying them to evade detection by the verifier. The push attestation timeout (~10s) constrains the generation window, but TPM throughput allows stockpiling ~50-200 quotes, enabling approximately 8-33 minutes of undetected compromise with default settings.\n\nThe attack is limited to a single agent node (AK signature binding prevents cross-agent replay). The pull-mode (legacy) attestation path is not affected.\n\n**Affected versions:** \u003e= 7.14.0, \u003c= 7.14.1\n\n**CVSS:** 6.3 Medium (`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L`)\n\n| Metric | Value | Rationale |\n|---|---|---|\n| AV | Local | Exploitation requires local access to the agent machine (stop agent, access TPM, run replacement). The network transmission of quotes to the verifier is normal protocol operation. |\n| AC | Low | Deterministic attack: publicly visible nonce, standard `tpm2-tools`, no race conditions. |\n| PR | High | Root on a legitimate enrolled node is required. The vulnerability does not help gain access -- it only helps evade detection after root is obtained. No value against a machine the attacker already controls. |\n| UI | None | Fully automated after initial setup. |\n| S | Unchanged | AK signature binding confines impact to the single compromised agent. |\n| C | High | Compromised node continues receiving bootstrap keys, payloads, and secrets intended for trusted nodes. |\n| I | High | Verifier cannot distinguish a healthy system from a fully compromised one during the evasion window. |\n| A | Low | Only the compromised agent's revocation and incident response are suppressed; the system as a whole remains operational. |\n\nThe base score does not fully capture the operational severity: Keylime exists to detect machine compromise, so 8-33 minutes of undetected compromise is operationally critical. The fix is a one-line change and should be applied immediately regardless of the base score.\n\n### Patches\n\nThe fix restores the original random nonce generation (one-line change in `keylime/models/verifier/evidence.py`):\n\n```python\n# Before (vulnerable):\ndef generate_challenge(self, bit_length):\n    # self.challenge = Nonce.generate(bit_length)\n    self.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\n\n# After (fixed):\ndef generate_challenge(self, bit_length):\n    self.challenge = Nonce.generate(bit_length)\n```\n\nUsers should upgrade to the version containing this fix (7.14.2).\n\n### Workarounds\n\nThere is no complete workaround. The following existing mechanisms provide partial mitigation and are already active by default (no configuration needed):\n\n1. **TPM clock monotonicity check** limits each distinct stockpiled quote to a single use, bounding the total evasion time.\n2. **Push attestation timeout** (default 10s) prevents the attacker from going silent and constrains the quote generation window.\n\nReducing `quote_interval` increases the attestation frequency but does not prevent the stockpiling attack.\n\n### References\n\n- CWE-329: Generation of Predictable IV/Nonce (primary -- hardcoded nonce in cryptographic attestation protocol)\n- CWE-547: Use of Hard-Coded, Security-relevant Constants (hardcoded constant left in production code)\n- CWE-294: Authentication Bypass by Capture-replay (consequence -- enables replay attacks)\n- CWE-1241: Use of Predictable Algorithm in Random Number Generator\n- Introducing commit: [`2bf91197`](https://github.com/keylime/keylime/commit/2bf91197) via [PR #1814](https://github.com/keylime/keylime/pull/1814)\n- TCG TPM 2.0 Library Specification, Part 1, Section 18.4 (TPM2_Quote)\n- IETF RATS Architecture (RFC 9334), Section 8 (Freshness)","status":"published","published":"2026-05-11T14:42:46Z","modified":"2026-05-11T14:42:47Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-294","CWE-329","CWE-547","CWE-1241"],"updated_at":"2026-11-02T14:40:05.816188Z"},{"id":"GHSA-wc6p-4gwj-jcr8","title":"Duplicate Advisory: Keylime has a hardcoded attestation challenge nonce that allows replay attacks","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-q8w6-w55c-ccv5. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"withdrawn","published":"2026-05-06T12:30:28Z","modified":"2026-06-24T03:30:35Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-1241"],"updated_at":"2026-11-02T14:40:32.744157Z"}],"nvd":[{"id":"CVE-2026-6420","description":"A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"published","published":"2026-05-06T11:16:05.193Z","modified":"2026-11-05T22:18:52.947Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1241"],"updated_at":"2026-11-05T23:57:17.922269Z"}],"osv":[{"id":"CVE-2026-6420","title":"Keylime: keylime: security bypass due to hardcoded tpm quote nonce","description":"A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"published","published":"2026-05-06T10:19:39.121Z","modified":"2026-11-07T02:30:35.243452788Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-1241"],"updated_at":"2026-11-07T03:08:08.685113Z"},{"id":"GHSA-q8w6-w55c-ccv5","title":"Keylime has a hardcoded attestation challenge nonce that allows replay attacks","description":"## CVE-2026-6420: Hardcoded attestation challenge nonce allows replay attacks\n\n### Impact\n\nThe `CertificationParameters.generate_challenge()` method in the push attestation protocol uses a hardcoded challenge nonce instead of generating a cryptographically random value. This removes the nonce-based replay protection from TPM quote attestation.\n\nAn attacker with root access on a monitored agent node can exploit this by stockpiling valid TPM quotes (using `tpm2_quote` with the known nonce) before compromising the system, then replaying them to evade detection by the verifier. The push attestation timeout (~10s) constrains the generation window, but TPM throughput allows stockpiling ~50-200 quotes, enabling approximately 8-33 minutes of undetected compromise with default settings.\n\nThe attack is limited to a single agent node (AK signature binding prevents cross-agent replay). The pull-mode (legacy) attestation path is not affected.\n\n**Affected versions:** \u003e= 7.14.0, \u003c= 7.14.1\n\n**CVSS:** 6.3 Medium (`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L`)\n\n| Metric | Value | Rationale |\n|---|---|---|\n| AV | Local | Exploitation requires local access to the agent machine (stop agent, access TPM, run replacement). The network transmission of quotes to the verifier is normal protocol operation. |\n| AC | Low | Deterministic attack: publicly visible nonce, standard `tpm2-tools`, no race conditions. |\n| PR | High | Root on a legitimate enrolled node is required. The vulnerability does not help gain access -- it only helps evade detection after root is obtained. No value against a machine the attacker already controls. |\n| UI | None | Fully automated after initial setup. |\n| S | Unchanged | AK signature binding confines impact to the single compromised agent. |\n| C | High | Compromised node continues receiving bootstrap keys, payloads, and secrets intended for trusted nodes. |\n| I | High | Verifier cannot distinguish a healthy system from a fully compromised one during the evasion window. |\n| A | Low | Only the compromised agent's revocation and incident response are suppressed; the system as a whole remains operational. |\n\nThe base score does not fully capture the operational severity: Keylime exists to detect machine compromise, so 8-33 minutes of undetected compromise is operationally critical. The fix is a one-line change and should be applied immediately regardless of the base score.\n\n### Patches\n\nThe fix restores the original random nonce generation (one-line change in `keylime/models/verifier/evidence.py`):\n\n```python\n# Before (vulnerable):\ndef generate_challenge(self, bit_length):\n    # self.challenge = Nonce.generate(bit_length)\n    self.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\n\n# After (fixed):\ndef generate_challenge(self, bit_length):\n    self.challenge = Nonce.generate(bit_length)\n```\n\nUsers should upgrade to the version containing this fix (7.14.2).\n\n### Workarounds\n\nThere is no complete workaround. The following existing mechanisms provide partial mitigation and are already active by default (no configuration needed):\n\n1. **TPM clock monotonicity check** limits each distinct stockpiled quote to a single use, bounding the total evasion time.\n2. **Push attestation timeout** (default 10s) prevents the attacker from going silent and constrains the quote generation window.\n\nReducing `quote_interval` increases the attestation frequency but does not prevent the stockpiling attack.\n\n### References\n\n- CWE-329: Generation of Predictable IV/Nonce (primary -- hardcoded nonce in cryptographic attestation protocol)\n- CWE-547: Use of Hard-Coded, Security-relevant Constants (hardcoded constant left in production code)\n- CWE-294: Authentication Bypass by Capture-replay (consequence -- enables replay attacks)\n- CWE-1241: Use of Predictable Algorithm in Random Number Generator\n- Introducing commit: [`2bf91197`](https://github.com/keylime/keylime/commit/2bf91197) via [PR #1814](https://github.com/keylime/keylime/pull/1814)\n- TCG TPM 2.0 Library Specification, Part 1, Section 18.4 (TPM2_Quote)\n- IETF RATS Architecture (RFC 9334), Section 8 (Freshness)","status":"published","published":"2026-05-11T14:42:46Z","modified":"2026-07-13T16:43:16.346391063Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-1241","CWE-294","CWE-329","CWE-547"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"GHSA-wc6p-4gwj-jcr8","title":"Duplicate Advisory: Keylime has a hardcoded attestation challenge nonce that allows replay attacks","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-q8w6-w55c-ccv5. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.","status":"withdrawn","published":"2026-05-06T12:30:28Z","modified":"2026-06-24T03:45:23.749946026Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-1241"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"PYSEC-2026-2548","title":"Keylime has a hardcoded attestation challenge nonce that allows replay attacks","description":"## CVE-2026-6420: Hardcoded attestation challenge nonce allows replay attacks\n\n### Impact\n\nThe `CertificationParameters.generate_challenge()` method in the push attestation protocol uses a hardcoded challenge nonce instead of generating a cryptographically random value. This removes the nonce-based replay protection from TPM quote attestation.\n\nAn attacker with root access on a monitored agent node can exploit this by stockpiling valid TPM quotes (using `tpm2_quote` with the known nonce) before compromising the system, then replaying them to evade detection by the verifier. The push attestation timeout (~10s) constrains the generation window, but TPM throughput allows stockpiling ~50-200 quotes, enabling approximately 8-33 minutes of undetected compromise with default settings.\n\nThe attack is limited to a single agent node (AK signature binding prevents cross-agent replay). The pull-mode (legacy) attestation path is not affected.\n\n**Affected versions:** \u003e= 7.14.0, \u003c= 7.14.1\n\n**CVSS:** 6.3 Medium (`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L`)\n\n| Metric | Value | Rationale |\n|---|---|---|\n| AV | Local | Exploitation requires local access to the agent machine (stop agent, access TPM, run replacement). The network transmission of quotes to the verifier is normal protocol operation. |\n| AC | Low | Deterministic attack: publicly visible nonce, standard `tpm2-tools`, no race conditions. |\n| PR | High | Root on a legitimate enrolled node is required. The vulnerability does not help gain access -- it only helps evade detection after root is obtained. No value against a machine the attacker already controls. |\n| UI | None | Fully automated after initial setup. |\n| S | Unchanged | AK signature binding confines impact to the single compromised agent. |\n| C | High | Compromised node continues receiving bootstrap keys, payloads, and secrets intended for trusted nodes. |\n| I | High | Verifier cannot distinguish a healthy system from a fully compromised one during the evasion window. |\n| A | Low | Only the compromised agent's revocation and incident response are suppressed; the system as a whole remains operational. |\n\nThe base score does not fully capture the operational severity: Keylime exists to detect machine compromise, so 8-33 minutes of undetected compromise is operationally critical. The fix is a one-line change and should be applied immediately regardless of the base score.\n\n### Patches\n\nThe fix restores the original random nonce generation (one-line change in `keylime/models/verifier/evidence.py`):\n\n```python\n# Before (vulnerable):\ndef generate_challenge(self, bit_length):\n    # self.challenge = Nonce.generate(bit_length)\n    self.challenge = bytes.fromhex(\"49beed365aac777dae23564f5ad0ec\")\n\n# After (fixed):\ndef generate_challenge(self, bit_length):\n    self.challenge = Nonce.generate(bit_length)\n```\n\nUsers should upgrade to the version containing this fix (7.14.2).\n\n### Workarounds\n\nThere is no complete workaround. The following existing mechanisms provide partial mitigation and are already active by default (no configuration needed):\n\n1. **TPM clock monotonicity check** limits each distinct stockpiled quote to a single use, bounding the total evasion time.\n2. **Push attestation timeout** (default 10s) prevents the attacker from going silent and constrains the quote generation window.\n\nReducing `quote_interval` increases the attestation frequency but does not prevent the stockpiling attack.\n\n### References\n\n- CWE-329: Generation of Predictable IV/Nonce (primary -- hardcoded nonce in cryptographic attestation protocol)\n- CWE-547: Use of Hard-Coded, Security-relevant Constants (hardcoded constant left in production code)\n- CWE-294: Authentication Bypass by Capture-replay (consequence -- enables replay attacks)\n- CWE-1241: Use of Predictable Algorithm in Random Number Generator\n- Introducing commit: [`2bf91197`](https://github.com/keylime/keylime/commit/2bf91197) via [PR #1814](https://github.com/keylime/keylime/pull/1814)\n- TCG TPM 2.0 Library Specification, Part 1, Section 18.4 (TPM2_Quote)\n- IETF RATS Architecture (RFC 9334), Section 8 (Freshness)","status":"published","published":"2026-07-13T15:15:44.116389Z","modified":"2026-07-13T16:32:00.954380755Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"RHSA-2026:28582","title":"Red Hat Security Advisory: keylime security update","status":"published","published":"2026-06-24T10:08:43Z","modified":"2026-10-03T10:09:20Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RLSA-2026:28582","title":"Moderate: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.\n\nSecurity Fix(es):\n\n* keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-25T12:05:27.708216Z","modified":"2026-06-25T12:30:04.278563025Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ALSA-2026:28582","title":"Moderate: keylime security update","description":"Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.  \n\nSecurity Fix(es):  \n\n  * keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-23T00:00:00Z","modified":"2026-10-29T11:30:19.055995515Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"openSUSE-SU-2026:10779-1","title":"keylime-config-7.14.2-1.1 on GA media","description":"These are all security issues fixed in the keylime-config-7.14.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-14T00:00:00Z","modified":"2026-05-15T09:00:20.276965Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21025-1","title":"Security update for keylime","description":"This update for keylime fixes the following issue\n\n- CVE-2026-6420: use of hardcoded challenge nonce for TPM quote attestation allows for security bypass (bsc#1264265).\n\nChanges for keylime:\n\n- Update to version 7.14.2.\n","status":"published","published":"2026-06-22T14:35:18Z","modified":"2026-06-30T18:24:28.757948078Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22326-1","title":"Security update for keylime","description":"This update for keylime fixes the following issue\n\n- CVE-2026-6420: use of hardcoded challenge nonce for TPM quote attestation allows for security bypass (bsc#1264265).\n\nChanges for keylime:\n\n- Update to version 7.14.2.\n","status":"published","published":"2026-06-22T14:27:22Z","modified":"2026-07-02T18:24:10.967391272Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}