Описание
Security update for p11-kit
This update for p11-kit fixes the following issues:
- CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
- CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems (bsc#1280702).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1269664
- SUSE Bug 1280702
- SUSE CVE CVE-2026-13757 page
- SUSE CVE CVE-2026-18938 page
Описание
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
Затронутые продукты
Ссылки
- CVE-2026-13757
- SUSE Bug 1269664
Описание
A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems.
Затронутые продукты
Ссылки
- CVE-2026-18938
- SUSE Bug 1280702