CVE-2025-13609

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

This vulnerability is rated Important for Red Hat products as the Keylime registrar allows an attacker to perform an identity takeover. By registering a new agent with a duplicate UUID, an attacker can overwrite an existing agent's identity, enabling impersonation and potential bypass of security controls. This affects Keylime in Red Hat Enterprise Linux and Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.