CVE-2020-29363: 
NixOS vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability was discovered in p11-kit versions 0.23.6 through 0.23.21 (CVE-2020-29363). The vulnerability affects the RPC protocol used by p11-kit server/remote commands and the client library. This issue was discovered in December 2020 and was patched in version 0.23.22 (GitHub Advisory).

The vulnerability occurs when the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, where the receiving entity may not allocate sufficient length for the buffer to store the deserialized value. This heap-based buffer overflow is classified as CWE-787 (Out-of-bounds Write). The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability but no direct impact on confidentiality or integrity. A successful exploitation could potentially lead to system crashes or service disruptions (NVD).

The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). This makes it relatively straightforward to exploit if left unpatched (NVD).

The vulnerability was fixed in p11-kit version 0.23.22. Users are strongly advised to upgrade to this version or later. Debian released security update DSA-4822-1 to address this vulnerability in their distributions (Debian Advisory).