426 matches found
CVE-2026-33317
CVE-2026-33317 OP-TEE PKCS11 PoC 本仓库包含针对 CVE-2026-33317 / GHSA-8cqw-mg7v-c9p9 的 Normal World 概念验证（PoC）、复现说明及捕获日志。 官方 OP-TEE 公告描述了 entrygetattributevalue 中针对 PKCS11CMDGETATTRIBUTEVALUE 的缺失校验问题。该漏洞可能导致从 PKCS11 TA 堆中进行越界读取，并且在属性模板格式错误时，可向临时模板缓冲区之外进行写入。本 PoC 针对越界写入场景，并演示 PKCS11 TA 中 Secure World 堆损坏。...
PKCS11SSHAgent
SRO PKCS11 – SSH Agent CNG PKCS11 + SSHエージェント + Pageant + CNG/スマートカードの主権的統合 伝統的に分離されていた4つの機能を1つのWindows実行ファイルに統合します： 完全なPKCS11モジュール（Firefox、OpenSC、ssh -I） OpenSSH/Git/VS/WSL対応のSSHエージェント PuTTY/plink/pscp対応のPageantサーバー スマートカード向けの安全なCNG/KSPオーケストレーター 目次 1. 哲学 2. アーキテクチャ 3. 実行モード 4. インストール 5. 設定 6...
CVE-2023-38408
OpenSSH 漏洞 - CVE-2023-38408 📚 简介 在 OpenSSH（9.3p2 版本之前）中发现了一个漏洞。OpenSSH 中 ssh-agent 的 PKCS11 功能存在搜索路径不够可信的问题，如果 agent 被转发到攻击者控制的系统（/usr/lib 中的代码加载到 ssh-agent 中并不一定安全），则可能导致远程代码执行。此漏洞允许攻击者控制服务器上转发的 agent 套接字，并能够在客户端主机文件系统上写入，从而以运行 ssh-agent 的用户权限执行任意代码。 在下面的示例中，我们可以简要观察从探索到入侵 alice 用户的步骤。 步骤 1 - 攻击...
CVE-2023-38408
Vulnerabilidad en OpenSSH - CVE-2023-38408 📚 Introducción Se encontró una vulnerabilidad en OpenSSH antes de la versión 9.3p2. La funcionalidad PKCS11 en el ssh-agent de OpenSSH tiene una ruta de búsqueda insuficientemente confiable, lo que conduce a la ejecución remota de código si un agente se...
openssh: OpenSSH: ssh-agent allows remote execution of local operations
A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS11 tokens or utilize keys with destination...
openssh: OpenSSH: ssh-agent allows remote execution of local operations
A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS11 tokens or utilize keys with destination...
Astra Linux – Vulnerability in gnutls28
A flaw was discovered in GnuTLS. The gnutlspkcs11tokensetpin function, which is used to change the Security Officer PIN, can lead to a use-after-free vulnerability. This occurs when an attacker attempts to change the PIN with a NULL old PIN for a token that lacks a protected authentication path...
Astra Linux – Vulnerability in gnutls28
A flaw was discovered in libgnutls. A remote attacker could trigger a short heap overread by sending an extremely short premaster secret during an RSA key exchange to a server that uses an RSA key backed by a PKCS11 token. This memory corruption vulnerability could lead to information disclosure...
CVE-2026-73281
A flaw was found in OpenSSH's ssh-agent component. A misinteraction between agent locking and the [email protected] extension allows operations intended for local execution to be performed remotely. This could enable a remote attacker to add PKCS11 tokens or utilize keys with destination...
[SECURITY] Fedora 43 Update: p11-kit-0.26.5-1.fc43
p11-kit provides a way to load and enumerate PKCS11 modules, as well as a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable...
CVE-2026-41434: Stack-based Buffer Overflow
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.10.0 and prior to version 4.11.0, an unbounded recursion can crash the PKCS11 TA. Version 4.11.0 contains a patch. ...
ALSA-2026:28231 Moderate: opencryptoki security update
The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor with the PKCS11 firmware loaded, the IBM eServer Cryptographic Accelerator FC 4960 ...
AZL-89184 CVE-2026-5260 affecting package gnutls for versions less than 3.8.13-1
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure...
CVE-2026-5260: Buffer Over-read
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure...
CVE-2026-33317: Out-of-bounds Read
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In versions 3.13.0 through 4.10.0, missing checks in entrygetattributevalue in ta/pkcs11/src/object.c can lead to out-of-bounds read from...
AZL-82982 CVE-2026-40253 affecting package opencryptoki 3.24.0-3
openCryptoki is a PKCS11 library and provides tooling for Linux and AIX. In versions 3.26.0 and below, the BER/DER decoding functions in the shared common library asn1.c accept a raw pointer but no buffer length parameter, and trust attacker-controlled BER length fields without validating them...
Oracle Linux 9 : gnutls (ELSA-2026-4188)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-4188 advisory. - Fix PKCS11 token initialization label overflow CVE-2025-9820 Tenable has extracted the preceding description block directly from the Oracle Linux...
OESA-2026-1417 gnutls security update
GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, and other...
OESA-2026-1381 opencryptoki security update
openCryptoki is an implementation of the PKCS 11 API that allows interfacing to devices that hold cryptographic information and perform cryptographic functions. openCryptoki provides application portability by isolating the application from the details of the cryptographic device. Isolating the...
