Use-after-free in OpenSC - CVE-2021-42779
Published: August 5, 2022
Vulnerability identifier: #VU66142
CSH Severity: Low
CVSS v4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-42779
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to perform a denial of service attack.
The vulnerability exists due to a use-after-free error in Opensc in sc_file_valid. An attacker with physical access can trigger use-after-free to perform a denial of service attack.
Affected software
OpenSC
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
opensc
opensc-debuginfo
opensc-debugsource
opensc-32bit
opensc-32bit-debuginfo
dev-libs/opensc
Amazon Linux AMI
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
opensc
opensc-debuginfo
opensc-debugsource
opensc-32bit
opensc-32bit-debuginfo
dev-libs/opensc
How to mitigate CVE-2021-42779
Install updates from vendor's website.
OpenSC - update to 0.22.0
opensc - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debuginfo - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debugsource - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-32bit - update to 0.19.0-150100.3.16.1
opensc-32bit-debuginfo - update to 0.19.0-150100.3.16.1
dev-libs/opensc - update to 0.22.0
opensc - update to 0.22.0-4
opensc - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debuginfo - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-debugsource - addressed in versions 0.13.0-3.19.1, 0.18.0-150000.3.23.1, 0.19.0-150100.3.16.1
opensc-32bit - update to 0.19.0-150100.3.16.1
opensc-32bit-debuginfo - update to 0.19.0-150100.3.16.1
dev-libs/opensc - update to 0.22.0
opensc - update to 0.22.0-4