CVE-2023-38200 – This vulnerability in Keylime's registrar compo... (How to Fix)

Q: What is the severity of CVE-2023-38200?

CVE-2023-38200 has a CVSS score of 7.5 (HIGH). This vulnerability in Keylime's registrar component allows remote attackers to cause a denial of service by exhausting all available SSL connections due to their blocking nature. It affects systems running vulnerable versions of Keylime, particularly those with internet-facing registrar services.

📋 TL;DR

This vulnerability in Keylime's registrar component allows remote attackers to cause a denial of service by exhausting all available SSL connections due to their blocking nature. It affects systems running vulnerable versions of Keylime, particularly those with internet-facing registrar services.

💻 Affected Systems

Products:

Keylime

Versions: Versions prior to 7.5.0

Operating Systems: Linux

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with Keylime registrar component enabled and accessible.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete unavailability of Keylime registrar service, disrupting attestation and provisioning capabilities for managed systems.

🟠

Likely Case

Service degradation or temporary unavailability of the registrar component under attack.

🟢

If Mitigated

Minimal impact if connections are rate-limited or the service is not internet-facing.

🌐 Internet-Facing: HIGH - Internet-facing registrars are directly exposed to connection exhaustion attacks.

🏢 Internal Only: MEDIUM - Internal attackers could still exploit this, but requires network access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple connection exhaustion attack requiring no authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 7.5.0

Vendor Advisory: https://access.redhat.com/errata/RHSA-2023:5080

Restart Required: Yes

Instructions:

1. Update Keylime to version 7.5.0 or later. 2. Restart the Keylime registrar service. 3. Verify the service is running correctly.

🔧 Temporary Workarounds

Rate limit connections

linux

Implement connection rate limiting at network or application level

# Use iptables to limit connections per IP
iptables -A INPUT -p tcp --dport 8890 -m connlimit --connlimit-above 10 -j REJECT

Restrict network access

linux

Limit registrar access to trusted networks only

# Configure firewall to allow only specific IPs
iptables -A INPUT -p tcp --dport 8890 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 8890 -j DROP

🧯 If You Can't Patch

Implement strict network segmentation and limit registrar access to required systems only
Deploy a reverse proxy with connection limiting and DDoS protection capabilities

🔍 How to Verify

Check if Vulnerable:

Check Keylime version: keylime_verifier --version or rpm -q keylime

Check Version:

keylime_verifier --version || rpm -q keylime || pip show keylime

Verify Fix Applied:

Verify version is 7.5.0 or later and test registrar connectivity under load

📡 Detection & Monitoring

Log Indicators:

High number of connection attempts in Keylime logs
Error messages about connection limits or timeouts

Network Indicators:

Unusual high volume of TCP connections to port 8890
Multiple connection attempts from single IPs

SIEM Query:

source="keylime.log" AND ("connection refused" OR "too many connections" OR "timeout")

📊 Metadata

CVE ID: CVE-2023-38200

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

Published: July 24, 2023

Last Updated: November 21, 2024

🔗 References

https://access.redhat.com/errata/RHSA-2023:5080 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-38200 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222692 Issue Tracking,Third Party Advisory
https://github.com/keylime/keylime/pull/1421 Patch
https://access.redhat.com/errata/RHSA-2023:5080 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-38200 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2222692 Issue Tracking,Third Party Advisory
https://github.com/keylime/keylime/pull/1421 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZIZZB5NHNCS5D2AEH3ZAO6OQC72IK7WS/

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-38200, you might also want to check these: