Keylime predictable algorithm in random number generator

Summaryinfo

A vulnerability identified as problematic has been detected in Keylime. Affected is an unknown function. The manipulation leads to use of predictable algorithm in random number generator. This vulnerability is traded as CVE-2026-6420. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Keylime (affected version not known). It has been rated as problematic. This issue affects some unknown functionality. The manipulation with an unknown input leads to a use of predictable algorithm in random number generator vulnerability. Using CWE to declare the problem leads to CWE-1241. The device uses an algorithm that is predictable and generates a pseudo-random number. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.

The advisory is shared at access.redhat.com. The identification of this vulnerability is CVE-2026-6420 since 04/16/2026. The exploitation is known to be easy. An attack has to be approached locally. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 319616 (Fedora 43 : keylime (2026-513c495139)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (319616) and EUVD (EUVD-2026-27657). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Keylime

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion