Opencryptoki
Monthly
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Privilege escalation in openCryptoki 2.3.2+ allows token-group members to exploit insecure symlink handling in group-writable token directories, enabling file operations on arbitrary filesystem targets when the library runs with elevated privileges. An attacker with token-group membership can plant symlinks to redirect administrative operations, potentially leading to privilege escalation or unauthorized data access. A patch is available.
openCryptoki is a PKCS#11 library and tools for Linux and AIX. [CVSS 6.6 MEDIUM]
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in. Rated medium severity (CVSS 6.2). No vendor patch available.
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc. Rated low severity (CVSS 2.9). No vendor patch available.
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Privilege escalation in openCryptoki 2.3.2+ allows token-group members to exploit insecure symlink handling in group-writable token directories, enabling file operations on arbitrary filesystem targets when the library runs with elevated privileges. An attacker with token-group membership can plant symlinks to redirect administrative operations, potentially leading to privilege escalation or unauthorized data access. A patch is available.
openCryptoki is a PKCS#11 library and tools for Linux and AIX. [CVSS 6.6 MEDIUM]
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in. Rated medium severity (CVSS 6.2). No vendor patch available.
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc. Rated low severity (CVSS 2.9). No vendor patch available.