REDHAT-BUG-2550361: Medium severity Red Hat clevis-pkcs11-afunix-socket-unlock vulnerability
The clevis-pkcs11-afunix-socket-unlock daemon creates two AFUNIX sockets (data socket at /run/systemd/clevis-pkcs11.sock and control socket at /run/systemd/clevis-pkcs11.control.sock) with no explicit permission restrictions and no peer credential verification. There is no umask(0077) before bind(), no fchmod() after bind(), and no SOPEERCRED check on accepted connections.
The data socket delivers LUKS passphrases to connecting processes. The control socket accepts arbitrary device/key pair injections from connecting processes. Socket permissions depend entirely on the inherited process umask — under systemd's default UMask=0022, sockets get mode 0755 which prevents unprivileged connect() (write permission required for AFUNIX stream sockets). However, in the dracut initramfs path or under a permissive umask, any process can connect and inject keys or receive passphrases.
The vulnerability is architectural: the code has zero authentication logic for its most critical function (key delivery), making the security posture entirely dependent on an inherited umask that is never verified in the code.
Affected files: src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c (controlthread and main socket handling) Versions affected: >= v21 through v22 (latest)
Steps to reproduce: 1. Start the daemon under permissive umask: (umask 0000; clevis-pkcs11-afunix-socket-unlock -l /run/systemd/clevis-pkcs11-systemd.log -f /run/systemd/clevis-pkcs11.sock -s 60 &) 2. Verify socket permissions: stat -c '%a' /run/systemd/clevis-pkcs11.control.sock shows 777 3. As non-root user, inject a key: echo -n "target-device,INJECTEDKEY" | socat - UNIX-CONNECT:/run/systemd/clevis-pkcs11.control.sock 4. The injected key is accepted and logged — no peer credential check is performed.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unprivileged local processes?
Deployments are exposed when either socket is created with permissions that allow unprivileged processes to connect, such as the dracut initramfs path or any permissive inherited umask. Under systemd's default UMask=0022, the sockets are mode 0755, and unprivileged users cannot connect because AF_UNIX stream sockets require write permission.
What could a local process do if it can connect to these sockets?
A process that connects to the data socket can receive LUKS passphrases. A process that connects to the control socket can inject arbitrary device/key pairs.
Does the daemon verify the identity of connecting processes?
No. The daemon does not perform peer credential verification, including an SO_PEERCRED check, and has no authentication logic for key delivery.
What configuration condition should be checked when triaging exposure?
Check the effective umask inherited by clevis-pkcs11-afunix-socket-unlock and the resulting permissions on /run/systemd/clevis-pkcs11.sock and /run/systemd/clevis-pkcs11.control.sock. The code does not set a restrictive umask or apply permissions after binding, so socket access depends entirely on that inherited umask.