The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to /run/systemd/clevis-pkcs11.pin at line 176:

  echo "${pin}" > /run/systemd/clevis-pkcs11.pin

No umask is set before this write. Under the default systemd UMask of 0022, the file is created with mode 0644 (world-readable). The file is later read by clevis-decrypt-pkcs11 (line 118) and deleted after use (line 131: rm -rf "${PIN_FILE}"). However, the on_exit trap in clevis-decrypt-pkcs11 only cleans the $CLEVIS_PKCS11 temporary directory, NOT the PIN file. If clevis-decrypt-pkcs11 exits early (multiple exit 1 paths before line 131) or is killed by a signal, the PIN file persists indefinitely.

The PIN is the authentication credential for the PKCS#11 token. While the PIN alone does not unlock the disk without physical access to the token, it enables an attacker to perform arbitrary private key operations on the token, potentially extracting LUKS key material independently of the daemon.

The race window between creation and deletion spans the full clevis-decrypt-pkcs11 invocation including PKCS#11 hardware decryption (typically 1-5 seconds on hardware tokens). Exploitation requires a local polling loop during boot but the window is reliably catchable on every boot.

Affected files: src/luks/systemd/clevis-luks-pkcs11-askpin.in (line 176), src/pins/pkcs11/clevis-decrypt-pkcs11 (cleanup gap)
Versions affected: >= v21 through v22 (latest)

Steps to reproduce:
1. Boot a system using Clevis PKCS#11 pin for LUKS decryption.
2. During boot, as any local user: while true; do cat /run/systemd/clevis-pkcs11.pin 2>/dev/null && break; done
3. If the timing window is hit, the PKCS#11 PIN is displayed.
4. Alternatively, if clevis-decrypt-pkcs11 exits early, the PIN file persists indefinitely and can be read at any time.