Unchecked Return Value in OpenSC - CVE-2021-42780

Vulnerability identifier: #VU66136

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42780

CWE-ID: CWE-252

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to perform denial of service attacks.

The vulnerability exists due to use after return issue in insert_pin() function in  Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.

OpenSC
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
opensc-pkcs11 (Ubuntu package)
opensc (Ubuntu package)
libopensc2
opensc
libopensc2-32bit
opensc-32bit
opensc-debuginfo
opensc-debugsource
opensc-debuginfo-32bit
opensc-32bit-debuginfo
opensc-help
dev-libs/opensc

Install updates from vendor's website.

OpenSC - update to 0.22.0
opensc-pkcs11 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.25.1-2ubuntu1.1
opensc (Ubuntu package) - addressed in versions Ubuntu Pro, 0.25.1-2ubuntu1.1
libopensc2 - update to 0.11.6-5.27.14.1
opensc - addressed in versions 0.11.6-5.27.14.1, 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
libopensc2-32bit - update to 0.11.6-5.27.14.1
opensc-32bit - addressed in versions 0.11.6-5.27.14.1, 0.19.0-150100.3.16.1
opensc-debuginfo - addressed in versions 0.11.6-5.27.14.1, 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debugsource - addressed in versions 0.11.6-5.27.14.1, 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debuginfo-32bit - update to 0.11.6-5.27.14.1
opensc-32bit-debuginfo - update to 0.19.0-150100.3.16.1
opensc-help - update to 0.20.0-10
opensc-debugsource - update to 0.20.0-10
opensc-debuginfo - update to 0.20.0-10
opensc - update to 0.20.0-10
dev-libs/opensc - update to 0.22.0

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
• https://github.com/OpenSC/OpenSC/commit/5df913b7
• https://bugzilla.redhat.com/show_bug.cgi?id=2016139

• Multiple vulnerabilities in OpenSC
• Gentoo update for OpenSC
• SUSE update for opensc
• SUSE update for opensc
• SUSE update for opensc
• SUSE update for opensc
• openEuler update for opensc
• Ubuntu update for opensc
• Ubuntu update for opensc
• Ubuntu update for opensc