#VU66136 Unchecked Return Value in OpenSC


Published: 2022-08-05 | Updated: 2022-08-05

Vulnerability identifier: #VU66136

Vulnerability risk: Low

CVSSv3.1: 2.1 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42780

CWE-ID: CWE-252

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
OpenSC
Universal components / Libraries / Libraries used by multiple products

Vendor: OpenSC

Description

The vulnerability allows an attacker with physical access to perform denial of service attacks.

The vulnerability exists due to use after return issue in insert_pin() function in  Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0 rc2


External links
http://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
http://github.com/OpenSC/OpenSC/commit/5df913b7
http://bugzilla.redhat.com/show_bug.cgi?id=2016139


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability