REDHAT-BUG-2550362: Medium severity Red Hat Clevis vulnerability
The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to /run/systemd/clevis-pkcs11.pin at line 176:
echo "${pin}" > /run/systemd/clevis-pkcs11.pin
No umask is set before this write. Under the default systemd UMask of 0022, the file is created with mode 0644 (world-readable). The file is later read by clevis-decrypt-pkcs11 (line 118) and deleted after use (line 131: rm -rf "${PINFILE}"). However, the onexit trap in clevis-decrypt-pkcs11 only cleans the $CLEVISPKCS11 temporary directory, NOT the PIN file. If clevis-decrypt-pkcs11 exits early (multiple exit 1 paths before line 131) or is killed by a signal, the PIN file persists indefinitely.
The PIN is the authentication credential for the PKCS#11 token. While the PIN alone does not unlock the disk without physical access to the token, it enables an attacker to perform arbitrary private key operations on the token, potentially extracting LUKS key material independently of the daemon.
The race window between creation and deletion spans the full clevis-decrypt-pkcs11 invocation including PKCS#11 hardware decryption (typically 1-5 seconds on hardware tokens). Exploitation requires a local polling loop during boot but the window is reliably catchable on every boot.
Affected files: src/luks/systemd/clevis-luks-pkcs11-askpin.in (line 176), src/pins/pkcs11/clevis-decrypt-pkcs11 (cleanup gap) Versions affected: >= v21 through v22 (latest)
Steps to reproduce: 1. Boot a system using Clevis PKCS#11 pin for LUKS decryption. 2. During boot, as any local user: while true; do cat /run/systemd/clevis-pkcs11.pin 2>/dev/null && break; done 3. If the timing window is hit, the PKCS#11 PIN is displayed. 4. Alternatively, if clevis-decrypt-pkcs11 exits early, the PIN file persists indefinitely and can be read at any time.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed?
Systems using the clevis-luks-pkcs11-askpin and clevis-decrypt-pkcs11 scripts with a PKCS#11 token are exposed. Under the default systemd UMask of 0022, the PIN file is created with mode 0644.
What access does an attacker need?
Exploitation requires local access and a polling loop during the period the PIN file exists. The normal exposure window spans the full clevis-decrypt-pkcs11 invocation, typically 1 to 5 seconds when hardware-token decryption is involved.
Does the PIN file always disappear after use?
No. It is deleted during the normal execution path, but it can persist indefinitely if clevis-decrypt-pkcs11 exits through an early error path or is terminated by a signal, because the exit trap does not remove the PIN file.
How can I check whether a PIN may have been left behind?
Check for the presence of /run/systemd/clevis-pkcs11.pin. Its presence indicates that the cleanup path did not remove the plaintext PIN file.
What could an attacker do with a recovered PIN?
The PIN alone does not unlock the disk without physical access to the token. However, it allows arbitrary private-key operations on the PKCS#11 token and could enable extraction of LUKS key material independently of the daemon.