CVE-2012-4454

Name of the Vulnerable Software and Affected Versions openCryptoki versions prior to 2.4.1

Description The issue allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the .pkapi xpk or .pkcs11spinloc file in /tmp. This is possible when using spinlocks.

Recommendations For versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation. Avoid using spinlocks until the issue is resolved.