Security readout for executives and security teams
Plain-English summary
Keylime can mishandle its check for a secure mount, letting secrets meant to stay protected become visible to other processes on the same host. This is a confidentiality issue, not an integrity or availability issue, but it matters where Keylime protects sensitive workload or attestation material.
Executive priority
Treat this as a high-priority confidentiality fix for Keylime-managed infrastructure. It is not confirmed exploited in the supplied sources, but secret leakage can undermine trust in protected workloads and attestation workflows.
Technical view
The Keylime agent before 6.3.0 can be fooled by previously created unprivileged mounts during secure mount validation. The result is potential exposure of secrets to other host processes. The issue is classified as CWE-200 with CVSS 3.1 score 7.5 and high confidentiality impact.
Likely exposure
Exposure is most likely on hosts running Keylime agent versions before 6.3.0, especially where unprivileged processes can create mounts and Keylime manages secrets on the host. The provided sources do not identify specific downstream distributions or package versions.
Exploitation context
The bundle does not cite active exploitation, and KEV is false. The vulnerability appears to require a host condition involving previously created unprivileged mounts that can fool the agent's secure mount logic. Do not assume internet-scale exploitation from the CVSS vector alone.
Researcher notes
Focus review on the agent's secure mount validation and handling of preexisting unprivileged mounts. The public record names two Keylime commits and a GitHub advisory, but the bundle does not provide broader exploit telemetry or downstream package mapping.
Mitigation direction
- Upgrade Keylime agents to 6.3.0 or later where vendor guidance confirms the fixed version.
- Review the GitHub advisory and remediation commits before applying distribution-specific packages.
- Restrict unnecessary unprivileged mount creation on affected hosts where operationally feasible.
- Prioritize hosts where Keylime protects sensitive workload, attestation, or deployment secrets.
Validation and detection
- Inventory hosts running Keylime agent and record installed versions.
- Confirm whether any agents are older than 6.3.0.
- Check vendor package changelogs for CVE-2022-23948 or referenced Keylime commits.
- Review host policy for unprivileged mount capability and local process isolation.
- After remediation, verify agents report the expected fixed package or release.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-23948 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://seclists.org/oss-sec/2022/q1/101CVE reference · x_refsource_MISC
- https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52CVE reference · x_refsource_MISC
- https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607CVE reference · x_refsource_MISC
- https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.