CVE-2020-29361: 
NixOS vulnerability analysis and mitigation

CVE-2020-29361 is a security vulnerability discovered in p11-kit versions 0.21.1 through 0.23.21. The vulnerability involves multiple integer overflows in the array allocations in both the p11-kit library and the p11-kit list command, where overflow checks were missing before calling realloc or calloc functions (GitHub Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue specifically relates to memory safety affecting the RPC protocol, where integer overflow conditions could occur during array allocations due to missing overflow checks in memory management functions (NVD).

If exploited, this vulnerability could allow an attacker to cause p11-kit to crash, resulting in a denial of service condition. The high CVSS score indicates significant potential impact on system availability (Debian Security).

The vulnerability is considered to have low attack complexity and requires no privileges or user interaction to exploit, as indicated by the CVSS vector string. However, there are no public reports of this vulnerability being actively exploited in the wild (NVD).

The vulnerability was fixed in p11-kit version 0.23.22 by implementing more extensive use of reallocarray. Users are recommended to upgrade to this version or later. Various Linux distributions have also released security updates to address this vulnerability, including Debian which patched it in version 0.23.15-2+deb10u1 for Debian 10 (Buster) and version 0.23.3-2+deb9u1 for Debian 9 (Stretch) (GitHub Advisory, Debian LTS).