CVE-2022-23950: High severity keylime (keylime) vulnerability
Published Sep 21, 2022
·Updated
In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
Affected Software
1 affected component
Keylime Keylime<6.3.0
Remediation
Patch Available
Event History
Sep 21, 2022
CVE Published
via MITRE·06:25 PM
Data Sourced
via MITRE·06:25 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-23950.
2
What is the severity of CVE-2022-23950?
The severity of CVE-2022-23950 is high, with a severity value of 7.5.
3
How does CVE-2022-23950 affect the Keylime software?
CVE-2022-23950 affects the Keylime software version up to (but excluding) 6.3.0.
4
What is the potential impact of CVE-2022-23950?
CVE-2022-23950 allows unprivileged users to prohibit keylime operations by exploiting a fixed /tmp path for UNIX domain socket.
5
How can I fix CVE-2022-23950?
To fix CVE-2022-23950, update Keylime software to version 6.3.0 or later.