Keylime EUVD-2026-27657

Exploitation requires root-level access on the enrolled monitored machine where the Keylime agent runs; this is a critical precondition and not exploitable by unprivileged local users. The vulnerability is specific to push-model deployments where the agent initiates attestation to the verifier; pull-model (verifier pulls data from agent) and hybrid deployments are not affected. No special configuration is required beyond the default push-model architecture - the hardcoded nonce is part of the standard verifier code. An attacker must be able to observe or intercept the TPM quote exchange, which is feasible for root users with access to the agent process and network stack.

CVSS 6.3 (AV:L/AC:L/PR:H/UI:N/S:U) indicates local attack vector with high privileges required, low complexity, and no user interaction - constraining real-world risk. However, the prerequisite (root access on monitored endpoint) represents a significant pre-compromise condition; this is not a chain-starting vulnerability but rather a post-exploitation technique to maintain stealth. The tag 'Information Disclosure' aligns with the quote-replay mechanism exposing attestation data. The impact is substantial for security-conscious deployments relying on Keylime for integrity verification: an attacker already with root access can indefinitely spoof system integrity to evade tamper detection, which defeats the fundamental purpose of remote attestation. The limitation to push-model deployments reduces the blast radius compared to pull-model or hybrid deployments. No KEV status, EPSS score, or public POC data provided; absence of active exploitation signals suggests this may be a discovered-but-not-yet-widely-exploited flaw. For organizations using Keylime in critical attestation workflows, the risk is elevated because post-compromise detection evasion is a high-impact attacker goal; for others, the requirement for pre-existing root access makes this a secondary concern in the attack chain.

An attacker gains root access on a production server running Keylime agent in push-model mode through a separate vulnerability (e.g., kernel privilege escalation or supply-chain compromise). Before proceeding with their attack objectives, the attacker observes a TPM quote attestation cycle and captures the valid quote response signed by the TPM. Days or weeks later, after installing persistence mechanisms or modifying system firmware, the attacker replays the captured quote to the Keylime verifier, which accepts it as a valid fresh attestation because the hardcoded nonce matches. The verifier reports the system as trusted and uncompromised, allowing the attacker's backdoor to remain hidden from integrity monitoring systems.