CVE-2018-14780: Medium severity Yubico Piv Manager vulnerability

An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpivfetchobject(): {% highlight c %} if(sw == SWSUCCESS) { sizet outlen; int offs = ykpivgetlength(data + 1, &outlen); if(offs == 0) { return YKPIVSIZEERROR; } memmove(data, data + 1 + offs, outlen); len = outlen; return YKPIVOK; } else { return YKPIVGENERICERROR; } {% endhighlight %} -- in the end, a memmove() occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the memmove() could copy bytes behind the allocated data buffer into this buffer.