CVE-2023-2977: Buffer Overflow
A vulnerability was found in OpenSC. This issue causes a buffer overrun in the pkcs15 cardoshaveverifyrcpackage. This flaw allows an attacker to supply a smart card package with a malformed ASN1 context. The cardoshaveverifyrcpackage function scans the ASN1 buffer for two tags, where the remaining length is wrongly calculated due to a moved starting pointer, leading to a possible heap-based buffer out-of-bounds read. In cases where ASN is enabled while compiling, this problem causes a crash, and further information leaks or more damage is likely.
Other sources
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage. The attacker can supply a smart card package with malformed ASN1 context. The cardoshaveverifyrcpackage function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.
Buffer overrun vulnerability in pkcs15 cardoshaveverifyrcpackage https://github.com/OpenSC/OpenSC/issues/2785
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openscto a version that resolves this vulnerability.Fixed in 0.21.0-1+deb11u1Fixed in 0.23.0-0.3+deb12u2Fixed in 0.26.1-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenSC vulnerability?
The vulnerability ID for this OpenSC vulnerability is CVE-2023-2977.
What is the severity of CVE-2023-2977?
CVE-2023-2977 has a severity rating of 7.1 (high).
What is the impact of the buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package?
The buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package allows an attacker to supply a smart card package with a malformed ASN1 context, potentially leading to arbitrary code execution or a denial of service.
Which versions of OpenSC are affected by CVE-2023-2977?
OpenSC version 0.23.0 is affected by CVE-2023-2977.
How can I fix the CVE-2023-2977 vulnerability in OpenSC?
To fix the CVE-2023-2977 vulnerability in OpenSC, update to a version that includes the fix provided in the OpenSC GitHub repository pull request.