The flaw occurs in the clevis PKCS#11 pin service, where the clevis-pkcs11-afunix-socket-unlock daemon creates Unix domain sockets without specifying permission bits or verifying the peer’s credentials. A permissive umask allows any local user to connect to the control socket and inject arbitrary device or key pairs, and to the data socket to retrieve LUKS passphrases. This can lead to the compromise of encrypted storage by providing an attacker with a fresh key or by capturing the passphrase used to unlock a LUKS volume.

Affected products are Red Hat Enterprise Linux releases 7 through 10 and Red Hat OpenShift Container Platform 4, according to the CNA information. The flaw applies to the clevis threads and associated systemd service and dracut initramfs components present in those distributions.

The CVSS score of 4.7 indicates a medium severity vulnerability. The EPSS score of less than 1 % suggests a very low probability of exploitation at this time, and the issue is not yet Listed in CISA KEV. The attack vector is local: an attacker must be able to run processes on the affected host and trigger a tunable umask (e.g. via a root‑owned process launched by a local user). If successful, the attacker could inject keys or exfiltrate the passphrase for a LUKS volume, potentially yielding full data compromise for that storage. No network access is required.