REDHAT-BUG-2263929: Use After Free
The Use After Free vulnerability was identified within the AuthentIC driver in OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or administrator enrolls or modifies cards. An attacker must have physical access to the computer system to take advantage of this flaw. The attack requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can potentially allow for compromising card management operations during enrollment.
Originally reported by OSS-fuzz automated service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2263929?
REDHAT-BUG-2263929 is classified as a critical vulnerability due to its potential for exploitation with physical access.
How do I fix REDHAT-BUG-2263929?
To fix REDHAT-BUG-2263929, update to the latest version of the OpenSC AuthentIC driver that addresses this vulnerability.
What software is affected by REDHAT-BUG-2263929?
REDHAT-BUG-2263929 affects the OpenSC AuthentIC driver specifically during the card enrollment process.
What is the nature of the vulnerability in REDHAT-BUG-2263929?
The nature of the vulnerability in REDHAT-BUG-2263929 is a Use After Free flaw, which can lead to unintended code execution.
Who can exploit REDHAT-BUG-2263929?
An attacker must have physical access to the computer system to exploit REDHAT-BUG-2263929.