CVE-2020-29361: Integer Overflow
An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.
Other sources
p11-glue p11-kit are vulnerable to a denial of service, caused by multiple integer overflows when allocating memory for arrays of attributes and object identifiers. By sending a specially-crafted request using realloc or calloc function, an attacker could exploit this vulnerability to cause a denial of service or possibly execute arbitrary code on the system.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-29361?
CVE-2020-29361 is a vulnerability in p11-kit versions 0.21.1 through 0.23.21 that allows for denial of service through multiple integer overflows when allocating memory.
How severe is CVE-2020-29361?
CVE-2020-29361 has a severity rating of 7.5, which is considered high.
Which software versions are affected by CVE-2020-29361?
p11-kit versions 0.21.1 through 0.23.21 are affected by CVE-2020-29361.
How can an attacker exploit CVE-2020-29361?
An attacker can exploit CVE-2020-29361 by sending a specially-crafted request using realloc or calloc function.
Are there any fixes available for CVE-2020-29361?
Yes, there are fixes available for CVE-2020-29361 in versions 0.23.15-2+deb10u1, 0.23.22-1, 0.24.1-2, and 0.25.0-5 of p11-kit.