A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() in p11-kit/rpc-message.c form a mutually-recursive call chain with no depth limit when processing CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attribute types. Similarly, proto_read_attribute_buffer_array() in p11-kit/rpc-server.c recurses without bound for IS_ATTRIBUTE_ARRAY types.

An attacker who can connect to the p11-kit RPC server via Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*) can send a specially crafted C_CreateObject request with deeply nested template attributes (~50,000 levels, ~650KB wire data), causing stack exhaustion and a SIGSEGV/SIGBUS crash of the p11-kit process. No authentication is required beyond same-user access to the Unix domain socket.

This results in denial of service for the p11-kit server and any dependent processes such as SSH agents, VPN clients, or web browsers using p11-kit for PKCS#11 module management. The recursive attribute support was introduced in commit 6529b540 (Feb 2024) without a depth bound.