Buffer overflow in OpenSC - CVE-2023-40661

Vulnerability identifier: #VU82974

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40661

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the card enrollment process using pkcs15-init when a user or administrator enrolls cards. An attacker with physical access to the system can trigger memory corruption and execute arbitrary code with elevated privileges.

OpenSC
Amazon Linux AMI
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
Ubuntu
Fedora
opensc-pkcs11 (Ubuntu package)
opensc (Ubuntu package)
opensc-debuginfo
opensc
opensc-debugsource
opensc (Red Hat package)
opensc-doc
dev-libs/opensc

Install updates from vendor's website.

OpenSC - update to 0.24.0 rc1
opensc-pkcs11 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.25.1-2ubuntu1.1
opensc (Ubuntu package) - addressed in versions Ubuntu Pro, 0.25.1-2ubuntu1.1
opensc-debuginfo - addressed in versions 0.13.0-3.25.1, 0.19.0-150100.3.25.1, 0.22.0-150400.3.6.1
opensc - addressed in versions 0.13.0-3.25.1, 0.19.0-150100.3.25.1, 0.22.0-150400.3.6.1
opensc-debugsource - addressed in versions 0.13.0-3.25.1, 0.19.0-150100.3.25.1, 0.22.0-150400.3.6.1
opensc (Red Hat package) - addressed in versions 0.20.0-7.el8_9, 0.23.0-3.el9_3
opensc - update to 0.20.0-7.0.1
opensc-doc - update to 0.20.0-7.0.1
opensc - update to 0.23.0-3
dev-libs/opensc - update to 0.24.0
opensc - addressed in versions 0.24.0-1.fc38, 0.24.0-1.fc39

• https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
• https://bugzilla.redhat.com/show_bug.cgi?id=2240913
• https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
• https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
• https://access.redhat.com/security/cve/CVE-2023-40661

• Multiple vulnerabilities in OpenSC
• SUSE update for opensc
• SUSE update for opensc
• SUSE update for opensc
• Fedora 38 update for opensc
• Fedora 39 update for opensc
• Red Hat Enterprise Linux 9 update for opensc
• Red Hat Enterprise Linux 8 update for opensc
• Gentoo update for OpenSC
• Amazon Linux AMI update for opensc
• Ubuntu update for opensc
• Ubuntu update for opensc
• Anolis OS update for opensc
• Ubuntu update for opensc