CVE-2023-40660: Opensc: potential pin bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
Other sources
When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its internals. This is dangerous for OS logon/screen unlock and small tokens that are plugged permanently to the computer. The bypass was removed and OpenSC implemented explicit logout for most of the card drivers to prevent leaving unattended logged-in tokens
Affected versions: OpenSC 0.17.0 - 0.23.0
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651 https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40660?
CVE-2023-40660 is a vulnerability in OpenSC packages that allows a potential PIN bypass.
How does CVE-2023-40660 work?
When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed.
What is the severity of CVE-2023-40660?
The severity of CVE-2023-40660 is medium, with a CVSS score of 6.6.
How do I fix CVE-2023-40660?
To fix CVE-2023-40660, update to version 0.24.0 of OpenSC packages.
Are there any references for CVE-2023-40660?
Yes, you can refer to the following links for more information: [Red Hat Security Advisory](https://access.redhat.com/security/cve/CVE-2023-40660), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2240912), [GitHub Issue](https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651).