Bug 2550362 (CVE-2026-109970)
| Summary: | CVE-2026-109970 clevis: clevis: PKCS#11 token PIN written to world-readable file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Deadline: | 2026-12-07 | ||
The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to /run/systemd/clevis-pkcs11.pin at line 176: echo "${pin}" > /run/systemd/clevis-pkcs11.pin No umask is set before this write. Under the default systemd UMask of 0022, the file is created with mode 0644 (world-readable). The file is later read by clevis-decrypt-pkcs11 (line 118) and deleted after use (line 131: rm -rf "${PIN_FILE}"). However, the on_exit trap in clevis-decrypt-pkcs11 only cleans the $CLEVIS_PKCS11 temporary directory, NOT the PIN file. If clevis-decrypt-pkcs11 exits early (multiple exit 1 paths before line 131) or is killed by a signal, the PIN file persists indefinitely. The PIN is the authentication credential for the PKCS#11 token. While the PIN alone does not unlock the disk without physical access to the token, it enables an attacker to perform arbitrary private key operations on the token, potentially extracting LUKS key material independently of the daemon. The race window between creation and deletion spans the full clevis-decrypt-pkcs11 invocation including PKCS#11 hardware decryption (typically 1-5 seconds on hardware tokens). Exploitation requires a local polling loop during boot but the window is reliably catchable on every boot. Affected files: src/luks/systemd/clevis-luks-pkcs11-askpin.in (line 176), src/pins/pkcs11/clevis-decrypt-pkcs11 (cleanup gap) Versions affected: >= v21 through v22 (latest) Steps to reproduce: 1. Boot a system using Clevis PKCS#11 pin for LUKS decryption. 2. During boot, as any local user: while true; do cat /run/systemd/clevis-pkcs11.pin 2>/dev/null && break; done 3. If the timing window is hit, the PKCS#11 PIN is displayed. 4. Alternatively, if clevis-decrypt-pkcs11 exits early, the PIN file persists indefinitely and can be read at any time.