CVE-2026-40253: 
NixOS vulnerability analysis and mitigation

CVE-2026-40253 is an out-of-bounds read vulnerability in openCryptoki's BER/DER decoding functions located in usr/lib/common/asn1.c. It affects all versions of openCryptoki up to and including v3.26.0, impacting all token backends (Soft, ICA, CCA, TPM, EP11, ICSF) since the vulnerable code resides in the shared common library. The vulnerability was published on April 16, 2026, and a fix was released in v3.27.0. It carries a CVSS v3.1 base score of 6.8 (Medium) per the GitHub Security Advisory, with an alternate score of 6.1 (Medium) per NVD (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-125: Out-of-Bounds Read) is that all five primitive BER decoder functions — ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING, and ber_decode_CHOICE — accept a raw pointer with no buffer length parameter, blindly trusting the attacker-controlled BER-encoded length field without validating it against actual buffer boundaries. Additionally, ber_decode_INTEGER can produce integer underflows (CWE-191) when the encoded length is zero, causing data_len = len - 1 to wrap to CK_ULONG_MAX. The attack vector is local, requiring no privileges, and can be triggered by supplying a malformed BER-encoded cryptographic object through PKCS#11 operations (C_CreateObject, C_UnwrapKey), token objects loaded from disk (loadsave.c), or objects received from remote ICSF/EP11 backends. A complete proof-of-concept (poc_ber_decode.c) with 8 test cases demonstrating crashes and OOB reads detectable by AddressSanitizer is publicly available (GitHub Advisory, Patch Commit).

Successful exploitation can result in information disclosure of sensitive heap memory contents (e.g., cryptographic key material or other process memory) and denial of service via process crash. Because the vulnerable code is in the shared common library, all token backends are equally affected, broadening the attack surface across any deployment using openCryptoki on Linux or AIX. There is no integrity impact, but the combination of memory disclosure and availability loss is particularly concerning in cryptographic infrastructure contexts where key confidentiality is paramount (GitHub Advisory, Red Hat Bugzilla).

A complete, runnable proof-of-concept (poc_ber_decode.c) is publicly available in the GitHub Security Advisory, demonstrating 8 test cases that trigger memory safety bugs via direct calls to the vulnerable decoder functions with heap-allocated malformed payloads, confirmed by AddressSanitizer. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Identify target: Locate a system running openCryptoki v3.26.0 or earlier on Linux or AIX with PKCS#11 operations accessible (e.g., via a PKCS#11-enabled application, HSM backend, or token file access).
2. Craft malformed BER payload: Construct a malformed BER-encoded cryptographic object where the length field in the TLV (Tag-Length-Value) structure claims a size far exceeding the actual buffer. For example, allocate 3 bytes but set the length field to 127 (02 7F 41) for an INTEGER, or use long-form encoding (30 81 FF 00) for a SEQUENCE with claimed length 255.
3. Trigger via PKCS#11 operation: Supply the malformed object through one of the following attack surfaces:
   • Call C_CreateObject or C_UnwrapKey with the crafted BER-encoded key or certificate attribute.
   • Place a malformed token object file in the token's storage directory to be loaded via loadsave.c on next token initialization.
   • If targeting remote backends (ICSF/EP11), inject the malformed object through the remote backend communication channel.
4. Trigger integer underflow (optional): For ber_decode_INTEGER, supply a zero-length encoding (e.g., 02 00 00) to cause data_len = 0 - 1 = CK_ULONG_MAX, enabling subsequent out-of-bounds memory access.
5. Achieve OOB read: The decoder returns a pointer and a fabricated data_len without bounds validation; any caller that subsequently uses data_len for a memcpy or memory read will access heap memory beyond the allocated buffer, potentially leaking sensitive data or crashing the process (GitHub Advisory).

• Logs: Unexpected crashes or segmentation faults in openCryptoki daemon (pkcsslotd) or PKCS#11-consuming applications; AddressSanitizer reports referencing asn1.c functions (ber_decode_INTEGER, ber_decode_SEQUENCE, ber_decode_OCTET_STRING, ber_decode_BIT_STRING) in stack traces.
• File System: Unexpected or malformed token object files in the openCryptoki token storage directory (typically /var/lib/opencryptoki/) with anomalous BER-encoded content; newly placed or modified token files with oversized length fields in TLV structures.
• Process: Abnormal termination of processes linked against libopencryptoki or libpkcs11; core dumps from pkcsslotd or HSM-interfacing daemons; unusual memory access patterns detected by system-level memory protection tools (e.g., ASAN, Valgrind output in debug environments).
• Network (remote backend scenarios): Unexpected or malformed BER-encoded objects transmitted to/from ICSF or EP11 remote backend endpoints; anomalous connection patterns to HSM backend services from unauthorized sources.

Upgrade openCryptoki to v3.27.0 or apply the fix introduced in commit ed378f463ef73364c89feb0fc923f4dc867332a3, which adds a buf_len parameter to all affected BER decoder functions and validates header_size + len <= buf_len before proceeding. As a workaround, restrict access to PKCS#11 operations and token object files to trusted users and processes only, and avoid processing cryptographic objects from untrusted sources. SUSE has released updated packages addressing this vulnerability (SUSE-SU-2026:2355-1 and related advisories) (Patch Commit, GitHub Advisory, SUSE Advisory).

The vulnerability was discovered and reported by security researcher Sebastian Josue Alba Vives (handle: 0xS4bb1), who provided a detailed PoC and coordinated disclosure through the openCryptoki GitHub Security Advisory. Red Hat tracked the issue via Bugzilla (Bug 2459076) and classified it as medium severity. SUSE issued multiple security update announcements for affected openSUSE and SUSE Linux Enterprise packages. Coverage appeared on Linux security news aggregators including linuxsecurity.com and pro-linux.de (GitHub Advisory, Red Hat Bugzilla, SUSE Advisory).