Description
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
Problem types
Access of Uninitialized Pointer
Product status
0:0.26.2-1.el10 (rpm) before *
0:0.26.2-1.el9 (rpm) before *
0:0.26.2-1.el9 (rpm) before *
0.26.2-1.1.hum1 (rpm) before *
1780420428 (rpm) before *
1779798159 (rpm) before *
1779798164 (rpm) before *
1779798165 (rpm) before *
1779798222 (rpm) before *
Timeline
| 2026-02-06: | Reported to Red Hat. |
| 2026-02-06: | Made public. |
Credits
This issue was discovered by Zoltan Fridrich (Red Hat).
References
access.redhat.com/errata/RHSA-2026:18143 (RHSA-2026:18143)
access.redhat.com/errata/RHSA-2026:18599 (RHSA-2026:18599)
access.redhat.com/errata/RHSA-2026:21275 (RHSA-2026:21275)
access.redhat.com/errata/RHSA-2026:22634 (RHSA-2026:22634)
access.redhat.com/errata/RHSA-2026:7065 (RHSA-2026:7065)
access.redhat.com/security/cve/CVE-2026-2100
bugzilla.redhat.com/show_bug.cgi?id=2437308 (RHBZ#2437308)
github.com/p11-glue/p11-kit/pull/740