CVE-2024-1454: Opensc: memory use after free in authentic driver when updating token info
The Use After Free vulnerability was identified within the AuthentIC driver in OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls or modifies cards. An attacker must have physical access to the computer system to take advantage of this flaw. The attack requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can potentially allow for compromising card management operations during enrollment.
Originally reported by OSS-fuzz automated service.
Other sources
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1454?
CVE-2024-1454 is classified as a Use After Free vulnerability, posing a serious risk if exploited.
How do I fix CVE-2024-1454?
To fix CVE-2024-1454, you should update to the latest patched version of OpenSC or the applicable Red Hat Enterprise Linux release.
Which software versions are affected by CVE-2024-1454?
CVE-2024-1454 affects OpenSC versions below 0.25.0 and specific versions of Fedora and Red Hat Enterprise Linux.
Can CVE-2024-1454 be exploited remotely?
CVE-2024-1454 requires physical access to the affected system for an attacker to exploit it.
What impact does CVE-2024-1454 have on system security?
Exploitation of CVE-2024-1454 could allow an attacker to execute arbitrary code, compromising system security.