CVE-2022-23948

Published: Sep 21, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.

Affected (1)

Products: Keylime: Keylime

Keylime

1 product

Keylime

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Keylime Keylime	Before 6.3.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (8)

https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607

Source: patrick@puiterwijk.org

PatchThird Party Advisory

https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724

Source: patrick@puiterwijk.org

PatchThird Party Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52

Source: patrick@puiterwijk.org

Third Party Advisory

https://seclists.org/oss-sec/2022/q1/101

Source: patrick@puiterwijk.org

ExploitMailing ListPatchThird Party Advisory

https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://seclists.org/oss-sec/2022/q1/101

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListPatchThird Party Advisory

Timeline

No history available yet.