Bug 2550385

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The clevis-pkcs11-afunix-socket-unlock daemon crashes when any AF_UNIX client connects to the data socket without calling bind() first.

In main(), after accept() on the data socket, the daemon calls getpeername() to learn the client's address (lines 312-317). For an unbound client, getpeername() returns len = sizeof(sa_family_t) = 2. The code then computes:

  pathlen = len - offsetof(struct sockaddr_un, sun_path);   // 2 - 2 = 0

pathlen is socklen_t (unsigned). At line 320:

  strncpy(peer, peer_addr.sun_path+1, pathlen-1);           // 0 - 1 = UINT32_MAX

This passes UINT32_MAX as the copy length to strncpy on a 0-byte stack VLA. With _FORTIFY_SOURCE (enabled in all Fedora/RHEL builds), __strncpy_chk detects the destination buffer size mismatch and calls abort(). Without _FORTIFY_SOURCE, this would be a stack buffer overflow.

Additionally, peer_addr (line 196) is never zeroed between loop iterations. A prior connection from a bound client leaves attacker-controlled data in peer_addr.sun_path, which becomes the source for the overflowing strncpy on the next (unbound) connection. This provides approximately 106 bytes of attacker-controlled source data, though _FORTIFY_SOURCE and stack canaries independently prevent exploitation beyond DoS.

The trigger is standard socket client behavior — any tool that calls connect() without bind() (socat, netcat, debugging scripts) will crash the daemon.

Affected file: src/pins/pkcs11/clevis-pkcs11-afunix-socket-unlock.c (lines 311-320)
Versions affected: >= v21 through v22 (latest)

Steps to reproduce:
1. Start the daemon: clevis-pkcs11-afunix-socket-unlock -l /run/systemd/clevis-pkcs11-systemd.log -f /run/systemd/clevis-pkcs11.sock -s 0 -t 100
2. Connect without bind(): socat - UNIX-CONNECT:/run/systemd/clevis-pkcs11.sock < /dev/null
3. The daemon aborts with "*** buffer overflow detected ***: terminated" (exit code 134 / SIGABRT).