Multiple vulnerabilities in OpenSC

1) Double Free

EUVDB-ID: #VU66143

Risk: Low

CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42778

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform a denial of service attack.

The vulnerability exists due to a boundary error. An attacker with physical access can pass specially crafted data to the application, trigger double free error, and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2

External links

http://bugzilla.redhat.com/show_bug.cgi?id=2016083
http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
http://github.com/OpenSC/OpenSC/commit/f015746d

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU66142

Risk: Low

CVSSv3.1: 1.8 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42779

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform a denial of service attack.

The vulnerability exists due to a use-after-free error in Opensc in sc_file_valid. An attacker with physical access can trigger use-after-free to perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2

External links

http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843
http://bugzilla.redhat.com/show_bug.cgi?id=2016086
http://github.com/OpenSC/OpenSC/commit/1db88374

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-based buffer overflow

EUVDB-ID: #VU66141

Risk: Low

CVSSv3.1: 1.8 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42781

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform denial of service attack.

The vulnerability exists due to a boundary error in Opensc before in pkcs15-oberthur.c. An attacker with physical access can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2

External links

http://bugzilla.redhat.com/show_bug.cgi?id=2016439
http://github.com/OpenSC/OpenSC/commit/17d8980c
http://github.com/OpenSC/OpenSC/commit/5d4daf6c
http://github.com/OpenSC/OpenSC/commit/40c50a3a
http://github.com/OpenSC/OpenSC/commit/05648b06
http://github.com/OpenSC/OpenSC/commit/cae5c71f

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stack-based buffer overflow

EUVDB-ID: #VU66137

Risk: Low

CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42782

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform a denial of service attack.

The vulnerability exists due to a boundary error in Opensc in various places. An attacker with physical access can trigger stack-based buffer overflow and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2

External links

http://github.com/OpenSC/OpenSC/commit/1252aca9
http://github.com/OpenSC/OpenSC/commit/7114fb71
http://github.com/OpenSC/OpenSC/commit/78cdab94
http://github.com/OpenSC/OpenSC/commit/ae1cf0be
http://github.com/OpenSC/OpenSC/commit/456ac566
http://bugzilla.redhat.com/show_bug.cgi?id=2016448

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Unchecked Return Value

EUVDB-ID: #VU66136

Risk: Low

CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42780

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows an attacker with physical access to perform denial of service attacks.

The vulnerability exists due to use after return issue in insert_pin() function in  Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2

External links

http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
http://github.com/OpenSC/OpenSC/commit/5df913b7
http://bugzilla.redhat.com/show_bug.cgi?id=2016139

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.