Heap-based buffer overflow in OpenSC - CVE-2020-26570

Vulnerability identifier: #VU48687

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26570

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the sc_oberthur_read_file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

OpenSC
Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP
openEuler
Fedora
opensc (Alpine package)
opensc (Red Hat package)
opensc
opensc-debuginfo
opensc-debugsource
opensc-help

Install update from vendor's website.

OpenSC - update to 0.21.0
opensc (Alpine package) - update to 0.21.0-r0
opensc (Red Hat package) - update to 0.20.0-4.el8
opensc - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc-debuginfo - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc-debugsource - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc - update to 0.20.0-4
opensc-debuginfo - update to 0.20.0-4
opensc-debugsource - update to 0.20.0-4
opensc-help - update to 0.20.0-4
opensc - update to 0.21.0-1.fc33

• http://www.openwall.com/lists/oss-security/2020/11/24/4
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316
• https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e

• Heap-based buffer overflow in OpenSC
• Heap-based buffer overflow in opensc (Alpine package)
• Arch Linux update for opensc
• Red Hat Enterprise Linux 8 update for opensc
• SUSE update for opensc
• SUSE update for opensc
• SUSE update for opensc
• openEuler update for opensc
• Fedora 33 update for opensc