Executive brief
A security flaw in p11-kit, a tool used to manage security modules like smart cards and encryption keys, can allow a local user to crash the service. By sending a specially crafted request, an attacker can force the system to run out of memory and stop responding. This results in a denial of service for critical applications that rely on p11-kit, such as web browsers, VPN clients, and SSH agents.
Technical details
A flaw exists in p11-kit's RPC message attribute parsing functions, specifically p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value(). These functions form a mutually-recursive call chain without a recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated local attacker with access to the p11-kit RPC Unix domain socket can send a crafted C_CreateObject request with deeply nested template attributes. This triggers stack exhaustion, leading to a SIGSEGV/SIGBUS crash of the p11-kit server process and any dependent services. The vulnerability was introduced in commit 6529b540.
Affected products
- p11-kit p11-kit Introduced in commit 6529b540 (Feb 2024)
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 6
- Red Hat Red Hat OpenShift Container Platform 4
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory