Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file
Impact
A flaw in Clevis logs LUKS passphrases in plaintext to a world-readable file. A local attacker can read the log file to obtain the passphrase. The issue affects Red Hat Enterprise Linux 7, 8, 9, and 10.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Configure the clevis-luks-pkcs11-askpass systemd service with a restrictive UMask by creating a service override using systemctl edit. Setting UMask to 0077 prevents the log file from being readable by non-root users. Additionally, remove any existing log files under /run/systemd/clevis-pkcs11-*.log after each boot, as they may already contain passphrases from previous unlocks.
This workaround only covers the systemd service path. The dracut initramfs code path is not covered by this mitigation.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Red Hat · redhat
Red Hat Enterprise Linux 10
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 10
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:10Red Hat · redhat
Red Hat Enterprise Linux 7
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 7
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:7Red Hat · redhat
Red Hat Enterprise Linux 8
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:8Red Hat · redhat
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat
Red Hat OpenShift Container Platform 4
0 ranges
Red Hat · redhat
Red Hat OpenShift Container Platform 4
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/a:redhat:openshift:4Red Hat · redhat
Red Hat OpenShift Container Platform 4
0 ranges
Red Hat · redhat
Red Hat OpenShift Container Platform 4
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/a:redhat:openshift:4Red Hat · redhat
Red Hat OpenShift Container Platform 5
0 ranges
Red Hat · redhat
Red Hat OpenShift Container Platform 5
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/a:redhat:openshift:5Original source description
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-109968View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.