CVE-2020-29362 describes a heap-based buffer over-read vulnerability in p11-kit versions 0.21.1 through 0.23.21. This flaw occurs in the RPC protocol when a remote entity provides a byte array during a serialized PKCS#11 function call, allowing the receiving entity to read up to 4 bytes beyond the allocated heap memory. Rated Medium (CVSS 5.3), this vulnerability has a low impact on confidentiality and no impact on integrity or availability, requiring no user interaction and being network-exploitable. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.23.6, < 0.23.22CPE matchmatch criteria | cpe:2.3:a:p11-kit_project:p11-kit:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c
Dec 12, 2020An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.
Dec 8, 2020