CVE-2022-1053

CVE-2022-1053 is a critical vulnerability in Keylime and Fedora Keylime that allows an attacker to bypass critical security checks by manipulating agent registration data. Specifically, Keylime fails to enforce consistent agent registrar data between the tenant's EK/identity quote validation and the verifier's integrity quote validation. This enables an attacker to substitute a software TPM's Attestation Key (AK) after initial validation, breaking the entire chain of trust. With a CVSS score of 9.1 (Critical), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction. A successful exploit could lead to high confidentiality and integrity impacts, as an unvalidated AK is used by the verifier, compromising the system's trustworthiness. Currently, there is no public exploit intelligence available, such as Metasploit modules or ExploitDB entries, and it is not listed on the CISA KEV catalog. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or active exploitation at this time.