Stack-based buffer overflow - CVE-2020-26572

Vulnerability identifier: #VU48689

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-26572

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in tcos_decipher. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Arch Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP
openEuler
Fedora
opensc (Alpine package)
opensc (Red Hat package)
opensc
opensc-debuginfo
opensc-debugsource
opensc-help

Install update from vendor's website.

opensc (Alpine package) - update to 0.21.0-r0
opensc (Red Hat package) - update to 0.20.0-4.el8
opensc - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc-debuginfo - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc-debugsource - addressed in versions 0.13.0-3.11.1, 0.18.0-150000.3.23.1, 0.19.0-3.7.1
opensc - update to 0.20.0-6
opensc-debuginfo - update to 0.20.0-6
opensc-debugsource - update to 0.20.0-6
opensc-help - update to 0.20.0-6
opensc - update to 0.21.0-1.fc33

• http://www.openwall.com/lists/oss-security/2020/11/24/4
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967
• https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27b4817

• Stack-based buffer overflow in OpenSC
• Stack-based buffer overflow in opensc (Alpine package)
• Arch Linux update for opensc
• Red Hat Enterprise Linux 8 update for opensc
• SUSE update for opensc
• SUSE update for opensc
• SUSE update for opensc
• openEuler update for opensc
• Fedora 33 update for opensc