CVE-2026-22791: 
NixOS vulnerability analysis and mitigation

CVE-2026-22791 is a heap buffer overflow vulnerability in the CKM_ECDH_AES_KEY_WRAP implementation of openCryptoki, a PKCS#11 library for Linux and AIX. It affects versions 3.25.0 and 3.26.0, introduced by commit 785d757 (2024-06-24) which added CKM_ECDH_AES_KEY_WRAP support. A local attacker with low privileges can trigger out-of-bounds heap writes by supplying a compressed EC public key and invoking C_WrapKey, leading to heap corruption or denial-of-service. The vulnerability was published on January 13, 2026, with a CVSS v3.1 base score of 6.6 (Medium) (GitHub Advisory).

The root cause is an incorrect buffer size calculation (CWE-131) in usr/lib/common/mech_ec.c within the ecdh_aes_key_wrap() function. The total output buffer length is computed using ecdh_params.ulPublicDataLen — derived from the caller-supplied (possibly compressed) EC public key — but the internally generated transport key is always encoded in uncompressed form. For a P-256 key, a compressed point is 33 bytes while the uncompressed form is 65 bytes; the buffer is therefore undersized by 32 bytes. In the standard two-step PKCS#11 wrap flow, the caller first queries the required length (receiving the underestimated value), allocates a buffer of that size, then calls C_WrapKey again — at which point the uncompressed transport point (65 bytes) is memcpy'd into the 33-byte allocation, overwriting 32 bytes of adjacent heap memory. Only the Soft and ICA tokens support CKM_ECDH_AES_KEY_WRAP and are therefore affected (GitHub Advisory, Fix Commit).

Successful exploitation causes heap corruption in the host process using openCryptoki, which can result in denial-of-service (process crash) or, in more complex scenarios, potential integrity compromise of adjacent heap data. Confidentiality impact is assessed as low, while availability impact is high due to the likelihood of process termination from heap corruption. Applications and services that accept external EC public keys and perform key wrapping via CKM_ECDH_AES_KEY_WRAP are directly at risk (GitHub Advisory).

The vulnerability requires local access and low privileges, with no user interaction needed. A proof-of-concept is described in the GitHub Security Advisory, detailing the two-step C_WrapKey pattern with a compressed EC public key. The EPSS score is approximately 0.012% (0.000120), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Prerequisite: Obtain local access to a system running openCryptoki 3.25.0 or 3.26.0 with the Soft or ICA token configured, with at least low-privilege PKCS#11 session access.
2. Create or import a compressed EC key pair: Generate or import an EC key pair (e.g., P-256) where the public key is stored in compressed point form (33 bytes for P-256) into the openCryptoki token.
3. First C_WrapKey call (length query): Call C_WrapKey with the CKM_ECDH_AES_KEY_WRAP mechanism and a NULL output buffer pointer. openCryptoki returns the required buffer length calculated as compressed_point_len + wrapped_key_len (e.g., 33 + N bytes for P-256).
4. Allocate undersized buffer: Allocate an output buffer of exactly the reported size (e.g., 33 + N bytes).
5. Second C_WrapKey call (trigger overflow): Call C_WrapKey again with the allocated buffer. Internally, openCryptoki generates an uncompressed transport EC key (65 bytes for P-256) and copies it into the 33-byte allocation via memcpy, overwriting 32 bytes of adjacent heap memory.
6. Achieve heap corruption or DoS: The out-of-bounds write corrupts heap metadata or adjacent objects, causing the host process to crash (denial-of-service) or potentially enabling further exploitation depending on heap layout (GitHub Advisory).

• Logs: Unexpected crashes or segmentation faults in processes linked against openCryptoki (e.g., pkcsslotd, application processes using PKCS#11); heap corruption error messages in application logs or system journals.
• Process: Abnormal termination (SIGABRT, SIGSEGV) of processes invoking C_WrapKey with CKM_ECDH_AES_KEY_WRAP; repeated process restarts of PKCS#11-enabled services.
• File System: Core dump files generated by openCryptoki-linked processes in /var/crash/ or the application working directory, potentially indicating heap corruption events.

Upgrade openCryptoki to version 3.27.0, which includes the fix in commit e37e9127. The fix corrects the buffer size calculation to use the internally generated (uncompressed) EC transport key's actual point length rather than the caller-supplied (possibly compressed) key's length. For systems running 3.25.0 or 3.26.0 that cannot immediately upgrade, the fix commit e37e9127 can be applied as a patch. As a workaround, avoid using compressed EC public keys with CKM_ECDH_AES_KEY_WRAP operations until patched (GitHub Advisory, Fix Commit).

The vulnerability was reported by Pavel Kohout of Aisle Research and disclosed responsibly via GitHub's security advisory process. SUSE and openSUSE issued security updates for their distributions (SUSE-SU-2026:0291-1 and openSUSE-SU-2026:20233-1) addressing this CVE. The German Linux security community (pro-linux.de) also covered the issue. No significant broader social media or industry commentary beyond distribution-level advisories has been observed (GitHub Advisory).