CVE-2026-2100: P11-kit: null dereference via c_derivekey with specific null parameters
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the CDeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
Other sources
Summary: potential NULL dereference in p11-kit when calling CDeriveKey remotely with specific parameters.
Requirements to exploit: if an attacker calls CDeriveKey on a remote token with either mechanism IBM kyber or IBM btc derive, with specific mechanism parameter values set to NULL. The RPC-client might attempt to return an uninitialized value potentially resulting in a NULL dereference or undefined behavior.
A slight overhaul of p11rpcbuffergetibmkybermechparamupdate and p11rpcbuffergetibmbtcderivemechparamupdate functions where variable data could potentially be used uninitialized.
Report from static analysis:
1. Defect type: UNINIT 1. p11-kit-0.26.1/p11-kit/rpc-message.c:1706:2: vardecl: Declaring variable "data" without initializer. 11. p11-kit-0.26.1/p11-kit/rpc-message.c:1732:5: uninituseincall: Using uninitialized value "data" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.] 1730| 1731| if (params->pCipher && params->ulCipherLen == len) { 1732|-> memcpy(params->pCipher, data, len); 1733| params->ulCipherLen = len; 1734| } else { 2. Defect type: UNINIT 1. p11-kit-0.26.1/p11-kit/rpc-message.c:1706:2: vardecl: Declaring variable "data" without initializer. 11. p11-kit-0.26.1/p11-kit/rpc-message.c:1735:5: uninituse: Using uninitialized value "data". 1733| params->ulCipherLen = len; 1734| } else { 1735|-> params->pCipher = (void ) data; 1736| params->ulCipherLen = len; 1737| } 3. Defect type: UNINIT 1. p11-kit-0.26.1/p11-kit/rpc-message.c:1776:2: vardecl: Declaring variable "data" without initializer. 9. p11-kit-0.26.1/p11-kit/rpc-message.c:1797:4: uninituseincall: Using uninitialized value "data" when calling "memcpy". [Note: The source code implementation of the function has been overridden by a builtin model.] 1795| 1796| if (params->pChainCode && params->ulChainCodeLen == len) { 1797|-> memcpy(params->pChainCode, data, len); 1798| params->ulChainCodeLen = len; 1799| } else { 4. Defect type: UNINIT 1. p11-kit-0.26.1/p11-kit/rpc-message.c:1776:2: vardecl: Declaring variable "data" without initializer. 9. p11-kit-0.26.1/p11-kit/rpc-message.c:1800:4: uninituse: Using uninitialized value "data". 1798| params->ulChainCodeLen = len; 1799| } else { 1800|-> params->pChainCode = (void ) data; 1801| params->ulChainCodeLen = len; 1802| }
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Is CVE-2026-2100 publicly disclosed?
Yes, CVE-2026-2100 has been publicly disclosed and details are available through security channels.