CVE-2024-45619: Libopensc: incorrect handling length of buffers or files in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
Other sources
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
When buffers are partially filled with data, uninitialized parts of the buffer can be incorrectly accessed. The uninitialized variables were reflected in the following functions:
- insertcert - asn1encodepath - gemsafegetcertlen - setcosgeneratekey - schsmdeterminefreeid - coolkeyrsaop
Originally reported by Matteo Marini (Sapienza University of Rome)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openscto a version that resolves this vulnerability.Fixed in 0.21.0-1+deb11u1Fixed in 0.23.0-0.3+deb12u2Fixed in 0.26.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45619?
CVE-2024-45619 is classified as a high severity vulnerability.
How do I fix CVE-2024-45619?
To mitigate CVE-2024-45619, update your OpenSC tools and ensure you are on supported versions of Red Hat Enterprise Linux.
What systems are affected by CVE-2024-45619?
CVE-2024-45619 impacts OpenSC versions below 0.26.0 and specific versions of Red Hat Enterprise Linux, including 7.0, 8.0, and 9.0.
What kind of attacks does CVE-2024-45619 allow?
CVE-2024-45619 allows attackers to exploit crafted USB devices or smart cards to manipulate APDUs and potentially compromise system integrity.
Is there any workaround for CVE-2024-45619 until a patch is applied?
As a temporary measure, avoid using untrusted USB devices and smart cards until CVE-2024-45619 is properly addressed.