Bug 2550375 (CVE-2026-109976)

Summary: CVE-2026-109976 clevis: clevis: integer underflow in PKCS#11 data socket handler crashes daemon on unbound client connection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, security-response-team, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2550385    
Bug Blocks:    
Deadline: 2026-12-07   

Description OSIDB Bzimport 2026-10-13 11:57:07 UTC 
The clevis-pkcs11-afunix-socket-unlock daemon crashes when any AF_UNIX client connects to the data socket without calling bind() first.

In main(), after accept() on the data socket, the daemon calls getpeername() to learn the client's address (lines 312-317). For an unbound client, getpeername() returns len = sizeof(sa_family_t) = 2. The code then computes:

  pathlen = len - offsetof(struct sockaddr_un, sun_path);   // 2 - 2 = 0

pathlen is socklen_t (unsigned). At line 320:

  strncpy(peer, peer_addr.sun_path+1, pathlen-1);           // 0 - 1 = UINT32_MAX

This passes UINT32_MAX as the copy length to strncpy on a 0-byte stack VLA. With _FORTIFY_SOURCE (enabled in all Fedora/RHEL builds), __strncpy_chk detects the destination buffer size mismatch and calls abort(). Without _FORTIFY_SOURCE, this would be a stack buffer overflow.

Additionally, peer_addr (line 196) is never zeroed between loop iterations. A prior connection from a bound client leaves attacker-controlled data in peer_addr.sun_path, which becomes the source for the overflowing strncpy on the next (unbound) connection. This provides approximately 106 bytes of attacker-controlled source data, though _FORTIFY_SOURCE and stack canaries independently prevent exploitation beyond DoS.

The trigger is standard socket client behavior — any tool that calls connect() without bind() (socat, netcat, debugging scripts) will crash the daemon.

Affected file: src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c (lines 311-320)
Versions affected: >= v21 through v22 (latest)

Steps to reproduce:
1. Start the daemon: clevis-pkcs11-afunix-socket-unlock -l /run/systemd/clevis-pkcs11-systemd.log -f /run/systemd/clevis-pkcs11.sock -s 0 -t 100
2. Connect without bind(): socat - UNIX-CONNECT:/run/systemd/clevis-pkcs11.sock < /dev/null
3. The daemon aborts with "*** buffer overflow detected ***: terminated" (exit code 134 / SIGABRT).