Skip to content

GHSA-7fq3-xxgp-r83j

CVE Information

Vulnerable Code

p11-kit/rpc-server.c line 287 and p11-kit/rpc-message.c line 968.

Two mutually-recursive call chains have no recursion depth limit. p11_rpc_message_get_attribute calls p11_rpc_message_get_attribute_array_value for CKA_WRAP_TEMPLATE/CKA_UNWRAP_TEMPLATE/CKA_DERIVE_TEMPLATE types, which iterates and calls p11_rpc_message_get_attribute for each nested attribute. Similarly proto_read_attribute_buffer_array recurses for IS_ATTRIBUTE_ARRAY types.

Attack Path

  1. Attacker connects to p11-kit RPC server via Unix domain socket (/run/user//p11-kit/pkcs11-)
  2. Sends C_CreateObject request with deeply nested CKA_WRAP_TEMPLATE attributes (each containing one CKA_WRAP_TEMPLATE child)
  3. Each nesting level consumes 12-13 bytes of wire data and 80-256 bytes of stack
  4. With 8MB default stack and ~128 bytes/frame: ~62,500 levels needed (~750KB wire data)
  5. Stack exhaustion causes SIGSEGV/SIGBUS crash of the p11-kit process

Impact

Denial of service: crash of the p11-kit RPC server or any process loading a malicious PKCS#11 module. Affects p11-kit server, SSH agents, VPN clients, web browsers using p11-kit. No authentication required (Unix domain socket accepts any same-user connection). Recursive attribute support added in commit 6529b540 (Feb 2024) without a depth bound.