REDHAT-BUG-2494556: Medium severity p11-kit p11-kit vulnerability
A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute() and p11rpcmessagegetattributearrayvalue() in p11-kit/rpc-message.c form a mutually-recursive call chain with no depth limit when processing CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attribute types. Similarly, protoreadattributebufferarray() in p11-kit/rpc-server.c recurses without bound for ISATTRIBUTEARRAY types.
An attacker who can connect to the p11-kit RPC server via Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-) can send a specially crafted CCreateObject request with deeply nested template attributes (~50,000 levels, ~650KB wire data), causing stack exhaustion and a SIGSEGV/SIGBUS crash of the p11-kit process. No authentication is required beyond same-user access to the Unix domain socket.
This results in denial of service for the p11-kit server and any dependent processes such as SSH agents, VPN clients, or web browsers using p11-kit for PKCS#11 module management. The recursive attribute support was introduced in commit 6529b540 (Feb 2024) without a depth bound.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2494556?
The severity of REDHAT-BUG-2494556 is medium with a score of 4.
How do I fix REDHAT-BUG-2494556?
To fix REDHAT-BUG-2494556, update the p11-kit software to the latest patched version.
What components are affected by REDHAT-BUG-2494556?
The components affected by REDHAT-BUG-2494556 are the RPC message attribute parsing functions in p11-kit.
What flaw does REDHAT-BUG-2494556 describe?
REDHAT-BUG-2494556 describes a mutually-recursive call chain flaw in p11-kit when processing certain template attributes.
Is REDHAT-BUG-2494556 a critical vulnerability?
No, REDHAT-BUG-2494556 is categorized as a medium severity vulnerability.