Negative-size-param vulnerability in opensc
Summary
OSV-2020-2276: Negative-size-param in tcos_decipher. Affects opensc versions >= 9ffb9bae63c8b7fbababb8481a83f1b575e59a18, < fe6864c5f3ba9085acdac569b7567b911e01f445. Fixed in fe6864c5f3ba9085acdac569b7567b911e01f445. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is an open-source smart card library and middleware that provides a set of cryptographic functions for interacting with smart cards. It is commonly used in various applications that require smart card authentication and encryption. However, a vulnerability has been discovered in OpenSC that allows an attacker to trigger a negative-size-param crash, potentially leading to a denial of service or arbitrary code execution.
Vulnerability Detail
The vulnerability in OpenSC is caused by a negative-size-param issue in the tcos_decipher function. This vulnerability can be triggered by an attacker providing a negative size parameter to the function, leading to a crash in the sc_decipher and use_key functions. An attacker with the ability to exploit this vulnerability could potentially execute arbitrary code or cause a denial of service. The vulnerability was reported through the OSS-Fuzz project and has been assigned the ID OSV-2020-2276.
How To Fix
Minimum fixed version
fe6864c5f3ba9085acdac569b7567b911e01f445
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to a fixed version of OpenSC as soon as possible.
Conclusion
In conclusion, the negative-size-param vulnerability in OpenSC can potentially lead to a denial of service or arbitrary code execution. Users of OpenSC are advised to update their installations to a version that includes the fix for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is an open-source smart card library and middleware that provides cryptographic functions for interacting with smart cards.
This vulnerability can potentially lead to a denial of service or arbitrary code execution if exploited by an attacker.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzz testing on open-source software.
Yes, a fix for this vulnerability has been implemented in a later version of OpenSC. Users are advised to update their installations to a version that includes the fix.
No, there are no known workarounds for this vulnerability. It is recommended to update to a fixed version of OpenSC.
References
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
