CVE-2024-45616: Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs.
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.
Other sources
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card. The uninitialized variables were reflected in these functions:
- cardosmatchcard - itoaword, called from schexdump - scbintohex - strcmp, called from scasn1readtag - asn1decode - processfcp - dnieprocessfci - iso7816processfci - scpkcs15initparseinfo, mscextractrsapublickey - scbintohex - gidsreadmasterfile - scbintohex
Originally reported by Matteo Marini (Sapienza University of Rome)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openscto a version that resolves this vulnerability.Fixed in 0.21.0-1+deb11u1Fixed in 0.23.0-0.3+deb12u2Fixed in 0.26.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45616?
CVE-2024-45616 is considered a high severity vulnerability due to potential exploitation via crafted USB devices or Smart Cards.
How do I fix CVE-2024-45616?
To fix CVE-2024-45616, update to the latest versions of the affected software that have addressed this vulnerability.
What systems are affected by CVE-2024-45616?
CVE-2024-45616 affects Red Hat Enterprise Linux 7.0, 8.0, 9.0, and OpenSC versions below 0.26.0.
What type of attacks can exploit CVE-2024-45616?
CVE-2024-45616 can be exploited by attackers using a specially crafted USB device or Smart Card that presents malicious APDU responses.
Is there a workaround for CVE-2024-45616?
Currently, the recommended action for CVE-2024-45616 is to apply vendor patches rather than relying on workarounds.