Heap-buffer-overflow in iasecc_parse_acls in OpenSC
Summary
OSV-2023-1126: Heap-buffer-overflow in iasecc_parse_acls. Affects opensc versions >= fa709de8dc5045f390f321cb65c9c73c36d52dd0, < 8fc2c20c3f895569eeb58328bb882aec07325d3b. Fixed in 8fc2c20c3f895569eeb58328bb882aec07325d3b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSC is an open-source smart card library that provides a set of tools and libraries for interacting with smart cards. It is commonly used for managing and accessing cryptographic tokens, such as smart cards and USB tokens. The library allows applications to perform operations like authentication, encryption, and digital signatures using smart cards. However, a vulnerability has been discovered in the iasecc_parse_acls function of OpenSC, which can lead to a heap-buffer-overflow.
Vulnerability Detail
The vulnerability in OpenSC arises from a heap-buffer-overflow in the iasecc_parse_acls function. This function is responsible for parsing Access Control Lists (ACLs) used for defining permissions and access rights. An attacker can exploit this vulnerability by providing a specially crafted ACL, causing a heap-buffer-overflow when the function attempts to read beyond the bounds of the allocated buffer. This can lead to arbitrary code execution or a denial-of-service condition. The vulnerability has a medium severity rating.
How To Fix
Minimum fixed version
8fc2c20c3f895569eeb58328bb882aec07325d3b
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is recommended to apply the fix provided by the OpenSC project.
Conclusion
In conclusion, OpenSC is vulnerable to a heap-buffer-overflow in the iasecc_parse_acls function. This vulnerability can be exploited to execute arbitrary code or cause a denial-of-service condition. It is crucial to update to the latest version of OpenSC that includes the fix. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opensc →
FAQ
OpenSC is an open-source smart card library used for managing and accessing cryptographic tokens.
The vulnerability can lead to arbitrary code execution or a denial-of-service condition.
To fix the vulnerability, update your OpenSC installation to the latest version that includes the fix.
There is no known workaround for this vulnerability. Applying the fix is the recommended solution.
You can find more information about this vulnerability in the OSS-Fuzz report linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for opensc.
