Multiple issues with uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card. The uninitialized variables were reflected in these functions:
- cardosmatchcard - itoaword, called from schexdump - scbintohex - strcmp, called from scasn1readtag - asn1decode - processfcp - dnieprocessfci - iso7816processfci - scpkcs15initparseinfo, mscextractrsapublickey - scbintohex - gidsreadmasterfile - scbintohex
Originally reported by Matteo Marini (Sapienza University of Rome)
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. The uninitialized variables were reflected in the following functions:
- bcdmp, called from caclistcomparepath - cardoslifecycleget - scpkcs15readfile
Originally reported by Matteo Marini (Sapienza University of Rome)
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. One is only relevant to handling the card enrollment using the pkcs15-init tool. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.). The uninitialized variables were reflected in the following functions:
- cacreadfile - pivgetchallenge - scasn1decodeobjectid - scpkcs15emuschsmdecodecvc - doinitapp, scpkcs15initcreatepin
Originally reported by Matteo Marini (Sapienza University of Rome)
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
When buffers are partially filled with data, uninitialized parts of the buffer can be incorrectly accessed. The uninitialized variables were reflected in the following functions:
- insertcert - asn1encodepath - gemsafegetcertlen - setcosgeneratekey - schsmdeterminefreeid - coolkeyrsaop
Originally reported by Matteo Marini (Sapienza University of Rome)
Multiple issues with uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs