CVE-2023-38200: Keylime: registrar is subject to a dos against ssl connections
Impact Keylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port 8891) blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients (agents and tenants), which prevents normal operation. The problem does not affect the verifier.
Patches Users should upgrade to release 7.4.0
Other sources
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
— NVD
The Keylime Registrar is subject to a DoS attack against it's SSL connections because they are blocking and a fairly simple attack could exhaust all of the available connections.
References:
https://github.com/keylime/keylime/pull/1421
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-38200?
CVE-2023-38200 is a vulnerability found in Keylime that allows for a denial of service attack.
What is the impact of CVE-2023-38200?
The impact of CVE-2023-38200 is that an adversary can open a connection to the TLS port, blocking legitimate connections and preventing the `registrar` from serving any further clients.
Which software versions are affected by CVE-2023-38200?
Keylime, Red Hat Enterprise Linux 9.0, Fedora, and keylime package versions up to and excluding 7.4.0 are affected by CVE-2023-38200.
What is the severity of CVE-2023-38200?
The severity of CVE-2023-38200 is high, with a severity value of 7.5.
How do I fix CVE-2023-38200?
To fix CVE-2023-38200, update to keylime version 7.5.0 or newer.