REDHAT-BUG-2309286: Low severity OpenSC libopensc vulnerability
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. The uninitialized variables were reflected in the following functions:
- bcdmp, called from caclistcomparepath - cardoslifecycleget - scpkcs15readfile
Originally reported by Matteo Marini (Sapienza University of Rome)
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2309286?
The severity of REDHAT-BUG-2309286 is classified as high due to the potential for exploitation via crafted USB devices or smart cards.
How do I fix REDHAT-BUG-2309286?
To fix REDHAT-BUG-2309286, ensure that you update the libopensc library to the latest version provided by your distribution.
What components are affected by REDHAT-BUG-2309286?
REDHAT-BUG-2309286 affects the libopensc library and its tools, including the PKCS#11 module and related drivers.
What type of attack is associated with REDHAT-BUG-2309286?
The attack associated with REDHAT-BUG-2309286 involves using a specially crafted USB device or smart card to exploit the library's handling of APDUs.
Is there a specific workaround for REDHAT-BUG-2309286?
Currently, the recommended workaround for REDHAT-BUG-2309286 is to refrain from using untrusted USB devices or smart cards until a patch is applied.