Double Free in OpenSC - CVE-2021-42778

Vulnerability identifier: #VU66143

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-42778

CWE-ID: CWE-415

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker with physical access to perform a denial of service attack.

The vulnerability exists due to a boundary error. An attacker with physical access can pass specially crafted data to the application, trigger double free error, and perform a denial of service attack.

OpenSC
Gentoo Linux
openEuler
opensc
opensc-debuginfo
opensc-debugsource
opensc-help
dev-libs/opensc

Install updates from vendor's website.

OpenSC - update to 0.22.0
opensc - update to 0.20.0-10
opensc-debuginfo - update to 0.20.0-10
opensc-debugsource - update to 0.20.0-10
opensc-help - update to 0.20.0-10
dev-libs/opensc - update to 0.22.0

• https://bugzilla.redhat.com/show_bug.cgi?id=2016083
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
• https://github.com/OpenSC/OpenSC/commit/f015746d

• Multiple vulnerabilities in OpenSC
• Gentoo update for OpenSC
• openEuler update for opensc