Security readout for executives and security teams
Plain-English summary
Keylime is meant to help decide whether a device can be trusted. In this flaw, a bad TPM quote signature may be logged as an error but not cause the device to be marked untrusted. Business urgency is low, but organizations relying on Keylime for attestation should update promptly.
Executive priority
Prioritize remediation where Keylime attestation gates production trust, workload admission, or device compliance. For most organizations this is a low-severity maintenance update, but delayed remediation can weaken assurance in environments built around TPM-based trust decisions.
Technical view
Keylime's attestation verifier mishandles TPM quote signature validation failure. When a device submits a quote whose signature fails validation, the verifier logs an error but does not mark the device untrusted. This weakens attestation integrity, but the published CVSS requires local access and high privileges, with low integrity impact.
Likely exposure
Exposure is limited to environments using the affected Red Hat Enterprise Linux 9 keylime package, specifically 0:7.3.0-13.el9_3 as listed in the source bundle. Systems not using Keylime attestation are not indicated as affected by the provided evidence.
Exploitation context
The source bundle does not show CISA KEV listing, active exploitation, or public weaponization. The CVSS vector indicates local access, low attack complexity, and high privileges are required. Treat this as an attestation trust-control weakness rather than a broad remote compromise issue.
Researcher notes
The evidence identifies affected Red Hat Enterprise Linux 9 keylime package 0:7.3.0-13.el9_3 and upstream commit 95ce3d86bd2c53009108ffda2dcf553312d733db as relevant. It does not establish remote exploitation, public exploit use, or broad cross-vendor impact.
Mitigation direction
- Apply Red Hat RHSA-2024:1139 updates for keylime on affected RHEL 9 systems.
- Review Keylime verifier deployments that influence device trust or admission decisions.
- Monitor Red Hat CVE guidance for package-specific remediation and backport details.
- Confirm operational runbooks do not rely only on logs for attestation failure handling.
Validation and detection
- Inventory RHEL 9 systems with the keylime package installed.
- Check whether package version 0:7.3.0-13.el9_3 is present.
- Confirm keylime is updated according to RHSA-2024:1139.
- Review verifier logs for quote signature validation errors and trust decisions.
- Test normal attestation workflows after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1283: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-3674 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N0.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
2.3LowVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:1139CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-3674CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2222903CVE reference · issue-tracking, x_refsource_REDHAT
- https://github.com/keylime/keylime/commit/95ce3d86bd2c53009108ffda2dcf553312d733dbCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Mutable Attestation or Measurement Reporting Data
Mutable Attestation or Measurement Reporting Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.