CVE-2026-109976: Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AFUNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
Other sources
The clevis-pkcs11-afunix-socket-unlock daemon crashes when any AFUNIX client connects to the data socket without calling bind() first.
In main(), after accept() on the data socket, the daemon calls getpeername() to learn the client's address (lines 312-317). For an unbound client, getpeername() returns len = sizeof(safamilyt) = 2. The code then computes:
pathlen = len - offsetof(struct sockaddrun, sunpath); // 2 - 2 = 0
pathlen is socklent (unsigned). At line 320:
strncpy(peer, peeraddr.sunpath+1, pathlen-1); // 0 - 1 = UINT32MAX
This passes UINT32MAX as the copy length to strncpy on a 0-byte stack VLA. With FORTIFYSOURCE (enabled in all Fedora/RHEL builds), strncpychk detects the destination buffer size mismatch and calls abort(). Without FORTIFYSOURCE, this would be a stack buffer overflow.
Additionally, peeraddr (line 196) is never zeroed between loop iterations. A prior connection from a bound client leaves attacker-controlled data in peeraddr.sunpath, which becomes the source for the overflowing strncpy on the next (unbound) connection. This provides approximately 106 bytes of attacker-controlled source data, though FORTIFYSOURCE and stack canaries independently prevent exploitation beyond DoS.
The trigger is standard socket client behavior — any tool that calls connect() without bind() (socat, netcat, debugging scripts) will crash the daemon.
Affected file: src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c (lines 311-320) Versions affected: >= v21 through v22 (latest)
Steps to reproduce: 1. Start the daemon: clevis-pkcs11-afunix-socket-unlock -l /run/systemd/clevis-pkcs11-systemd.log -f /run/systemd/clevis-pkcs11.sock -s 0 -t 100 2. Connect without bind(): socat - UNIX-CONNECT:/run/systemd/clevis-pkcs11.sock < /dev/null 3. The daemon aborts with " buffer overflow detected : terminated" (exit code 134 / SIGABRT).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can trigger the crash?
A local actor that can connect to the daemon's AF_UNIX data socket can trigger it by connecting without first binding the client socket to an address. The supplied vector also indicates local access and low privileges are required.
What operational impact should administrators expect?
The daemon crash causes a denial of service that prevents LUKS disk decryption from completing during boot. Systems relying on this daemon for boot-time disk unlocking are therefore the relevant exposed deployments.
Does the observed behavior depend on build hardening?
With _FORTIFY_SOURCE, described as enabled in Fedora and RHEL builds, the invalid strncpy size is detected and the daemon aborts. Without _FORTIFY_SOURCE, the same condition would result in a stack buffer overflow rather than the documented controlled abort.