REDHAT-BUG-2550363: Medium severity Red Hat Clevis vulnerability
The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN via the -p command-line argument to pkcs11-tool at lines 121-122:
pkcs11-tool --login --decrypt --input-file ${ENC} \ -p ${PINvalue} ${moduleopt} ${mechanismoption} ${slotopt}
This makes the PIN visible to any local user via /proc/<pid>/cmdline or ps aux for the lifetime of the pkcs11-tool process. Unlike the daemon's -k flag (which is not used in production), this code path is exercised in the default production flow on every boot.
The PIN is the authentication credential for the PKCS#11 token. An attacker who captures the PIN and has physical access to the token can perform unauthorized private key operations.
The pkcs11-tool binary supports reading the PIN from an environment variable via the env: prefix on the -p flag (e.g., -p env:CLEVISPKCS11PIN), which would prevent command-line exposure since /proc/<pid>/environ is mode 0400 (owner-only). This is supported by pkcs11-tool's utilgetpin() function in OpenSC source (src/tools/util.c).
Additionally, the variables ${ENC}, ${PINvalue}, ${moduleopt}, ${mechanismoption}, ${slotopt} are all passed unquoted to pkcs11-tool, which is a secondary correctness issue (word splitting/globbing) but not security-critical.
Affected files: src/pins/pkcs11/clevis-decrypt-pkcs11 (lines 121-122) Versions affected: >= v21 through v22 (latest)
Steps to reproduce: 1. Boot a system using Clevis PKCS#11 pin for LUKS decryption. 2. During boot, as any local user: while true; do ps aux | grep '[p]kcs11-tool.-p' && break; sleep 0.01; done 3. If the timing window is hit, the PIN appears in the pkcs11-tool command-line arguments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Pass the PKCS#11 token PIN through the CLEVIS_PKCS11_PIN environment variable using pkcs11-tool's -p env:CLEVIS_PKCS11_PIN form instead of passing the PIN directly on the command line.
clevis-decrypt-pkcs11 / pkcs11-tool PIN input for the -p option = env:CLEVIS_PKCS11_PIN
Event History
Frequently Asked Questions
Are default production deployments affected?
Yes. The affected script path is exercised in the default production flow on every boot, so deployments using that flow expose the token PIN in the pkcs11-tool command line during its execution.
What does an attacker need to exploit the exposed PIN?
An attacker needs local access sufficient to view another process's command line through ps or /proc/<pid>/cmdline while pkcs11-tool is running. Capturing the PIN alone is not enough for token operations; the attacker also needs physical access to the PKCS#11 token.
What can be done before a permanent fix is available?
The PIN can be supplied through an environment variable using pkcs11-tool's env: prefix, such as -p env:CLEVIS_PKCS11_PIN, rather than directly on the command line. This avoids command-line exposure because /proc/<pid>/environ is owner-only mode 0400.
How can I identify the affected invocation?
Inspect the clevis-decrypt-pkcs11 script for a pkcs11-tool command that passes the PIN with -p ${PIN_value}. The reported invocation also passes ENC, PIN_value, module_opt, mechanism_option, and slot_opt without quoting.