CyberSecBulletin
CVE-2025-13609NVD status: Deferred

keylime: Use of Multiple Resources with Duplicate Identifier

Published Updated By the CyberSecBulletin desk

CVE-2025-13609 is a high-severity use of multiple resources with duplicate identifier vulnerability in keylime from Keylime Project, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an attacker with administrator privileges, without any action from a user. The record lists version 7.14.0 as the first without the flaw, so updating keylime to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.47% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update keylime to 7.14.0 or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
Keylime Projectkeylimebefore 7.14.07.14.0
Red HatRed Hat Enterprise Linux 10Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 10.0 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9Not specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP SolutionsNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.4 Extended Update SupportNot specified in the recordNot stated
Red HatRed Hat Enterprise Linux 9.6 Extended Update SupportNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
HighAdministrator-level access is required first.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
LowSome restricted data can be read.
Integrity
HighData or code can be modified at will.
Availability
LowPerformance or availability is reduced.

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L. Scored by CNA (redhat.com).

Official description

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Multiple Resources with Duplicate Identifier

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

How developers prevent this class of flaw

  • Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

More Use of Multiple Resources with Duplicate Identifier vulnerabilities (CWE-694)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Multiple Resources with Duplicate Identifier vulnerabilities

Spotted an error? Tell us.