Security update for rust-keylime SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:20717-1 Final 1 1 2025-09-16T07:50:08Z current 2025-09-16T07:50:08Z 2025-09-16T07:50:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rust-keylime This update for rust-keylime fixes the following issues: - Update vendored crate slab to version 0.4.11 * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function leading to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006) - Update to version 0.2.8+12: * build(deps): bump actions/checkout from 4 to 5 * build(deps): bump cfg-if from 1.0.0 to 1.0.1 * build(deps): bump openssl from 0.10.72 to 0.10.73 * build(deps): bump clap from 4.5.39 to 4.5.45 * build(deps): bump pest from 2.8.0 to 2.8.1 * Fix clippy warnings * Use verifier-provided interval for continuous attestation timing * Add meta object with seconds_to_next_attestation to evidence response * Fix boot time retrieval * Fix IMA log format (it must be ['text/plain']) (#1073) * Remove unnecessary configuration fields * cargo: Bump retry-policies to version 0.4.0 - Update vendored crate shlex to version 1.3.0 * CVE-2024-58266: Fixed command injection (bsc#1247193) - Update to version 0.2.7+141: * service: Use WantedBy=multi-user.target * rpm: Add subpackage for push-attestation agent * push-model: implement continuous attestation with configurable intervals * Retry registration forever in the state machine * Add Verifier URL to configuration * Align exp.backoff to current configuration format * Increase coverage of state machine (using Context) * Increase coverage of struct_filler.rs * Groom code (remove dead code) * Fix exponential backoff (10secs, 4xx accepted) * test: Add documentation test to tests/run.sh * tpm: Avoid running code example during documentation tests * state_machine: Always start the agent from the Unregistered state * Add fixes for the URL construction * Refactor evidences collection in push attestation agent * push-model: refactor attestation logic into a state machine * Fix body sending by allowing serializing strings (#1057) * Log ResilientClient errors/response status codes (#1055) * Add AK signing scheme and hash algorithm to negotiation * tpm: Add method to extract signing scheme and hash algorithm from AK * Allow custom content-type/accept headers * Integrate exponential backoff to registration (#1052) * keylime/structures: Rename ShaValues to PcrBanks * Add resilient_client for exponential backoff (#1048) - Update vendored crate openssl 0.10.73: * CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623) - Update to version 0.2.7+117: * Increase coverage in evidence handling structure * Add Capabilities Negotiations resp. missing fields * Fix UEFI test to check file access in all cases * context_info_handler: Do not assume /var/lib/keylime exists * Fix clippy warnings about uninlined format arguments * attestation: Allow unwrap() in tests * Increase coverage (groom code, extend unit tests) * Include IMA/UEFI logs in Evidence Handling request * Include method to get all IMA entries as string * Send correct list of pcr banks and sign algorithms * Try to fix TPM tests related issues * Define attestation perform asynchronous * Perform attestation in push model agent binary * Refactor code to use new attestation.rs * Create attestation.rs for Attestation stuff * Move ContextInfo management to its own handler * Adjust context_info.rs after rebase * Add attestation function to ContextInfo structure * Add prohibited signing algorithms, avoid ecschnorr * keylime/config: Use macro to implement PushModelConfigTrait * Introduce keylime-macros and define_view_trait * config: Remove KeylimeConfig structure * config: Remove unnecessary options and lazy initialization * Fix pcr_bank function to send all possible slots * Send Content-Type:application/json on request (#1039) * Send correct 'key_algorithm' in certification_keys (#1035) * Push Model: Persist Attestation Key to file * Add Keylime push model binary to root GNUmakefile * Use singleton to avoid multiple Context allocation * tests: Do not assume `/var/lib/keylime` exists (#1030) * lib/cert: Fix race condition due to use of same file path * payloads: Fix race condition in tests * Add uefi_log_handler.rs to parse UEFI binary * Use IMA log parser to send correct entry count * Add IMA log parser * build(deps): bump once_cell from 1.19.0 to 1.21.3 * lib/config/base.rs: Add more unit tests * lib/permissions: Add unit tests * keylime-agent: move JsonWrapper from common.rs to the library * lib/agent_data: Move agent_data related tests from common * common: Replace APIVersion with the library Version structure * keylime_agent: Move secure_mount.rs to the library * lib: Rename keylime_error.rs as error.rs * config: Move config to keylime library * config: Rename push_model_config to push_model * lib: Move permissions.rs from keylime-agent to the lib * Extract Capabilities Negotiation info from TPM (#1014) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Micro-6.0-461 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/ Link for SUSE-SU-2025:20717-1 https://lists.suse.com/pipermail/sle-updates/2025-September/041931.html E-Mail link for SUSE-SU-2025:20717-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1242623 SUSE Bug 1242623 https://bugzilla.suse.com/1247193 SUSE Bug 1247193 https://bugzilla.suse.com/1248006 SUSE Bug 1248006 https://www.suse.com/security/cve/CVE-2024-58266/ SUSE CVE CVE-2024-58266 page https://www.suse.com/security/cve/CVE-2025-3416/ SUSE CVE CVE-2025-3416 page https://www.suse.com/security/cve/CVE-2025-55159/ SUSE CVE CVE-2025-55159 page SUSE Linux Micro 6.0 rust-keylime-0.2.8+12-1.1 rust-keylime-0.2.8+12-1.1 as a component of SUSE Linux Micro 6.0 The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection. CVE-2024-58266 SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/ https://www.suse.com/security/cve/CVE-2024-58266.html CVE-2024-58266 https://bugzilla.suse.com/1247186 SUSE Bug 1247186 A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string. CVE-2025-3416 SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/ https://www.suse.com/security/cve/CVE-2025-3416.html CVE-2025-3416 https://bugzilla.suse.com/1242599 SUSE Bug 1242599 slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length. CVE-2025-55159 SUSE Linux Micro 6.0:rust-keylime-0.2.8+12-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/ https://www.suse.com/security/cve/CVE-2025-55159.html CVE-2025-55159 https://bugzilla.suse.com/1248000 SUSE Bug 1248000