CVE-2023-38201: Insufficient Information (NVD-CWE-noinfo)
value: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2023-08-25T17:15Z
Repository: https://github.com/keylime/keylime
Language: Python
Files changed: keylime/registrar_common.py
Commit date: 2023-08-23 17:46:33 -0300
Commit message: Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)

In addition to remove the offending message, this patch also ensures
deletion of an agent's record from the database in case of failure after
a single attempt.

Signed-off-by: Marcio Silva <marcio.a.silva@ibm.com>

Diff: diff --git a/keylime/registrar_common.py b/keylime/registrar_common.py
index 1fd97cd0..7f15ae43 100644
--- a/keylime/registrar_common.py
+++ b/keylime/registrar_common.py
@@ -248,11 +248,13 @@ class UnprotectedHandler(BaseHandler):
         port = json_body.get("port")
         if port is not None:
             try:
                 port = int(port)
                 if port < 1 or port > 65535:
-                    logger.warning("Contact port for agent %s is not a number between 1 and got: %s.", agent_id, port)
+                    logger.warning(
+                        "Contact port for agent %s is not a number between 1 and 65535 got: %s.", agent_id, port
+                    )
                     port = None
             except ValueError:
                 logger.warning("Contact port for agent %s is not a valid number got: %s.", agent_id, port)
                 port = None
 
@@ -445,11 +447,20 @@ class UnprotectedHandler(BaseHandler):
                     session.commit()
                 except SQLAlchemyError as e:
                     logger.error("SQLAlchemy Error: %s", e)
                     raise
             else:
-                raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")
+                if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
+                    try:
+                        session.commit()
+                    except SQLAlchemyError as e:
+                        logger.error("SQLAlchemy Error: %s", e)
+                        raise
+
+                raise Exception(
+                    f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
+                )
 
             web_util.echo_json_response(self, 200, "Success")
             logger.info("PUT activated: %s", agent_id)
         except Exception as e:
             web_util.echo_json_response(self, 400, f"Error: {str(e)}")

Vulnerable code:                     logger.warning("Contact port for agent %s is not a number between 1 and got: %s.", agent_id, port)
                raise Exception(f"Auth tag {auth_tag} does not match expected value {ex_mac}")
Fixed code:                     logger.warning(
                        "Contact port for agent %s is not a number between 1 and 65535 got: %s.", agent_id, port
                    )
                if agent_id and session.query(RegistrarMain).filter_by(agent_id=agent_id).delete():
                    try:
                        session.commit()
                    except SQLAlchemyError as e:
                        logger.error("SQLAlchemy Error: %s", e)
                        raise

                raise Exception(
                    f"Auth tag {auth_tag} for agent {agent_id} does not match expected value. The agent has been deleted from database, and a restart of it will be required"
                )