OpenSC: Segv on unknown address in sc_aux_data_free
Summary
OSV-2022-434: Segv on unknown address in sc_aux_data_free. Affects opensc versions >= 0773f4098ad424582af9f367fd7627fcdefba66e, < 367c3ad2ef2c10cb29602f72163e7fb23c3f5827. Fixed in 367c3ad2ef2c10cb29602f72163e7fb23c3f5827. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is an open-source smart card library that provides a set of tools and libraries for interacting with smart cards. It offers various functionalities such as card management, cryptographic operations, and authentication. This vulnerability affects the OpenSC package.
Vulnerability Detail
The vulnerability in OpenSC is triggered by a segmentation fault (segv) on an unknown address. The crash occurs in the sc_aux_data_free function, which is called by the sc_pkcs15_free_prkey_info and sc_pkcs15_free_object functions. The exact cause of the crash is not specified in the provided information. However, it is important to note that segmentation faults can lead to program crashes and potential security vulnerabilities.
How To Fix
Minimum fixed version
367c3ad2ef2c10cb29602f72163e7fb23c3f5827
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is mentioned in the provided information.
Conclusion
In conclusion, the OpenSC package is vulnerable to a segmentation fault on an unknown address. To mitigate this vulnerability, it is recommended to update the package to a version that includes the fix. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is an open-source smart card library that provides tools and libraries for interacting with smart cards.
The impact of this vulnerability is not specified in the provided information. However, segmentation faults can lead to program crashes and potential security vulnerabilities.
To fix this vulnerability, update the OpenSC package to a version that includes the fix. The fix can be found in commit 367c3ad2ef2c10cb29602f72163e7fb23c3f5827 of the OpenSC GitHub repository.
No workaround is mentioned in the provided information.
For more information about this vulnerability, you can refer to the OSS-Fuzz report at the following link: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47655
References
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
