CVE-2026-109970: Clevis: clevis: pkcs#11 token pin written to world-readable file
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
Other sources
The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to /run/systemd/clevis-pkcs11.pin at line 176:
echo "${pin}" > /run/systemd/clevis-pkcs11.pin
No umask is set before this write. Under the default systemd UMask of 0022, the file is created with mode 0644 (world-readable). The file is later read by clevis-decrypt-pkcs11 (line 118) and deleted after use (line 131: rm -rf "${PINFILE}"). However, the onexit trap in clevis-decrypt-pkcs11 only cleans the $CLEVISPKCS11 temporary directory, NOT the PIN file. If clevis-decrypt-pkcs11 exits early (multiple exit 1 paths before line 131) or is killed by a signal, the PIN file persists indefinitely.
The PIN is the authentication credential for the PKCS#11 token. While the PIN alone does not unlock the disk without physical access to the token, it enables an attacker to perform arbitrary private key operations on the token, potentially extracting LUKS key material independently of the daemon.
The race window between creation and deletion spans the full clevis-decrypt-pkcs11 invocation including PKCS#11 hardware decryption (typically 1-5 seconds on hardware tokens). Exploitation requires a local polling loop during boot but the window is reliably catchable on every boot.
Affected files: src/luks/systemd/clevis-luks-pkcs11-askpin.in (line 176), src/pins/pkcs11/clevis-decrypt-pkcs11 (cleanup gap) Versions affected: >= v21 through v22 (latest)
Steps to reproduce: 1. Boot a system using Clevis PKCS#11 pin for LUKS decryption. 2. During boot, as any local user: while true; do cat /run/systemd/clevis-pkcs11.pin 2>/dev/null && break; done 3. If the timing window is hit, the PKCS#11 PIN is displayed. 4. Alternatively, if clevis-decrypt-pkcs11 exits early, the PIN file persists indefinitely and can be read at any time.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can read the exposed credential?
Any local user able to read /run/systemd/clevis-pkcs11.pin can obtain the PKCS#11 token PIN when the file is created with the default systemd UMask of 0022, which results in mode 0644. The issue requires local access and low privileges.
What must an attacker have to use the disclosed PIN?
The attacker needs access to the exposed PIN file and physical access to the associated PKCS#11 token. The PIN alone does not unlock the disk without the token.
Are default settings affected?
Yes. The script does not set a restrictive umask before writing the PIN, so the default systemd UMask of 0022 creates the file as world-readable.
How can I determine whether a PIN may still be exposed?
Check for the presence of /run/systemd/clevis-pkcs11.pin. The file can remain indefinitely if clevis-decrypt-pkcs11 exits early or is terminated before its normal deletion step.
What can be done if an update cannot be applied immediately?
Restrict access to /run/systemd/clevis-pkcs11.pin and remove any lingering copy after use. Ensure the PIN file is created with restrictive permissions and account for early exits or signal termination so it is cleaned up.