Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_pubkey in opensc
Summary
OSV-2021-538: Heap-buffer-overflow in sc_pkcs15emu_oberthur_add_pubkey. Affects opensc versions >= 6903aebfddc466d966c7b865fae34572bf3ed23e, < 5d4daf6c92e4668f5458f380f3cacea3e879d91a. Fixed in 5d4daf6c92e4668f5458f380f3cacea3e879d91a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is an open-source smart card library that provides a set of tools and libraries for interacting with smart cards. It enables applications to access smart card functions such as authentication, encryption, and digital signatures. The sc_pkcs15emu_oberthur_add_pubkey function in OpenSC is responsible for adding a public key to the Oberthur smart card. However, a vulnerability has been discovered in this function that can lead to a heap-buffer-overflow read.
Vulnerability Detail
The vulnerability occurs when the sc_pkcs15emu_oberthur_add_pubkey function reads beyond the bounds of a heap buffer. This can result in the disclosure of sensitive information or the execution of arbitrary code. An attacker could exploit this vulnerability by crafting a malicious smart card that triggers the overflow when processed by an application using OpenSC. The vulnerability has a medium severity rating.
How To Fix
Minimum fixed version
5d4daf6c92e4668f5458f380f3cacea3e879d91a
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the sc_pkcs15emu_oberthur_add_pubkey function or disable the affected functionality that relies on it. However, it is strongly advised to apply the official fix by updating to the latest version of OpenSC.
Conclusion
In conclusion, a heap-buffer-overflow vulnerability has been discovered in the sc_pkcs15emu_oberthur_add_pubkey function in OpenSC. This vulnerability can be fixed by updating to the latest version of OpenSC. It is recommended to apply the official fix to ensure the security of applications using OpenSC. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is an open-source smart card library that provides tools and libraries for interacting with smart cards.
The sc_pkcs15emu_oberthur_add_pubkey function is responsible for adding a public key to the Oberthur smart card in OpenSC.
A heap-buffer-overflow vulnerability occurs when a program reads or writes data beyond the bounds of a heap buffer, potentially leading to memory corruption and security issues.
The vulnerability could allow an attacker to disclose sensitive information or execute arbitrary code by exploiting the heap-buffer-overflow read.
To fix this vulnerability, update to the latest version of OpenSC, which includes the patched code. The specific commit that addresses this issue is 5d4daf6c92e4668f5458f380f3cacea3e879d91a.
References
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
