CVE-2012-4454: Opencryptoki Project Opencryptoki

Low severity, CVSS 2.9. EPSS: 1% chance of exploitation in the next 30 days.

openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.

Affected products

• Opencryptoki Project Opencryptoki: up to and including 2.4; version 2.2.3 only; version 2.2.4 only; version 2.2.4.1 only; version 2.2.5 only; version 2.2.6 only; …

Published 2012-10-10. Last modified 2026-06-16.