USN-7346-1: OpenSC vulnerabilities
First published: Wed Mar 12 2025(Updated: )
It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780) It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a stack buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-42782) It was discovered that OpenSC did not correctly handle the length of certain buffers, which could lead to a out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977) Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero length PIN. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660) It was discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to compromise key generation, certificate loading and other card management operations. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40661) Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a timing side-channel and incorrectly handled RSA padding. An attacker could possibly use this issue to recover sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-5992) Matteo Marini discovered that OpenSC did not properly manage memory due to certain uninitialized variables. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. (CVE-2024-45618, CVE-2024-45620) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45619) It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a buffer overflow. A physically proximate attacker could possibly use this issue to compromise card management operations during enrollment and modification. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-8443)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/opensc | <0.25.1-2ubuntu1.1 | 0.25.1-2ubuntu1.1 |
| Ubuntu | =24.10 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.25.1-2ubuntu1.1 | 0.25.1-2ubuntu1.1 |
| Ubuntu | =24.10 | |
| All of | ||
| ubuntu/opensc | <0.25.0~rc1-1ubuntu0.1~esm1 | 0.25.0~rc1-1ubuntu0.1~esm1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.25.0~rc1-1ubuntu0.1~esm1 | 0.25.0~rc1-1ubuntu0.1~esm1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/opensc | <0.22.0-1ubuntu2+esm1 | 0.22.0-1ubuntu2+esm1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.22.0-1ubuntu2+esm1 | 0.22.0-1ubuntu2+esm1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/opensc | <0.20.0-3ubuntu0.1~esm2 | 0.20.0-3ubuntu0.1~esm2 |
| Ubuntu | =20.04 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.20.0-3ubuntu0.1~esm2 | 0.20.0-3ubuntu0.1~esm2 |
| Ubuntu | =20.04 | |
| All of | ||
| ubuntu/opensc | <0.17.0-3ubuntu0.1~esm2 | 0.17.0-3ubuntu0.1~esm2 |
| Ubuntu | =18.04 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.17.0-3ubuntu0.1~esm2 | 0.17.0-3ubuntu0.1~esm2 |
| Ubuntu | =18.04 | |
| All of | ||
| ubuntu/opensc | <0.15.0-1ubuntu1+esm2 | 0.15.0-1ubuntu1+esm2 |
| Ubuntu | =16.04 | |
| All of | ||
| ubuntu/opensc-pkcs11 | <0.15.0-1ubuntu1+esm2 | 0.15.0-1ubuntu1+esm2 |
| Ubuntu | =16.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2021-42780
- https://ubuntu.com/security/CVE-2024-45615
- https://ubuntu.com/security/CVE-2023-40660
- https://ubuntu.com/security/CVE-2024-45618
- https://ubuntu.com/security/CVE-2024-45617
- https://ubuntu.com/security/CVE-2024-45619
- https://ubuntu.com/security/CVE-2023-5992
- https://ubuntu.com/security/CVE-2024-45616
- https://ubuntu.com/security/CVE-2023-2977
- https://ubuntu.com/security/CVE-2021-42782
- https://ubuntu.com/security/CVE-2024-45620
- https://ubuntu.com/security/CVE-2024-8443
- https://ubuntu.com/security/CVE-2023-40661
- https://launchpad.net/ubuntu/+source/opensc/0.25.1-2ubuntu1.1
- https://ubuntu.com/security/notices/USN-7346-1 (Advisory)
Child vulnerabilities
(Contains the following vulnerabilities)
Frequently Asked Questions
What is the severity of USN-7346-1?
The severity of USN-7346-1 is considered high due to the potential for denial of service and arbitrary code execution.
How do I fix USN-7346-1?
To fix USN-7346-1, update OpenSC and OpenSC-PKCS11 to the latest versions provided by your Ubuntu repository.
Which versions of Ubuntu are affected by USN-7346-1?
USN-7346-1 affects Ubuntu 16.04, 18.04, 20.04, 22.04, and 24.04 LTS versions.
What type of vulnerability is associated with USN-7346-1?
USN-7346-1 is associated with a use-after-free vulnerability in OpenSC.
Can USN-7346-1 lead to data breaches?
Yes, USN-7346-1 can potentially allow attackers to execute arbitrary code, which could lead to data breaches.
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/source
- agent/references
- agent/tags
- agent/softwarecombine
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/event
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.10
- version/ubuntu/24.04
- version/ubuntu/22.04
- version/ubuntu/20.04
- version/ubuntu/18.04
- version/ubuntu/16.04