CVE-2024-45619.md

CVE-2024-45619: Incorrect handling length of buffers or files in libopensc

The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.

When buffers are partially filled with data, uninitialized parts of the buffer can be incorrectly accessed. The uninitialized variables were reflected in the following functions:

• insert_cert
  • missing check for empty read file (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L65)
  • found via fuzz_pkcs11, fuzz_pkcs15_crypt, fuzz_pkcs15_decode, fuzz_pkcs15_encode
  • fixed with
    • f01bfbd19b9c8243a40f7f17d554fe0eb9e89d0d
    • a1d8c01c1cabd115dda8c298941d1786fb4c5c2f
• asn1_encode_path
  • function insert_cert accessing buffer after filled length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L70-L77)
  • found via fuzz_pkcs15_encode
  • fixed with
    • f01bfbd19b9c8243a40f7f17d554fe0eb9e89d0d
    • a1d8c01c1cabd115dda8c298941d1786fb4c5c2f
• gemsafe_get_cert_len
  • accessing uninit(https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L763), iasecc_se_parse
  • missing checks for accessing data buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L764 and https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L322)
  • found via fuzz_pkcs15init
  • fixed with 673065630bf4aaf03c370fc791ef6a6239431214
• setcos_generate_key
  • missing check for data length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-setcos.c#L507)
  • found via fuzz_pkcs15init
  • fixed with e20ca25204c9c5e36f53ae92ddf017cd17d07e31
• sc_hsm_determine_free_id
  • incorrect checking of file list length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-sc-hsm.c#L143)
  • found via fuzz_pkcs15initialized part of buffer without checking actual buffer length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-gemsafeV1.c#L180)
  • found via fuzz_pkcs15_crypt, fuzz_pkcs15_decode
  • fixed with 2b6cd52775b5448f6a993922a30c7a38d9626134
• coolkey_rsa_op
  • missing check for length of buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-coolkey.c#L1770)
  • found via fuzz_pkcs15_reader
  • fixed with dd554a2e1e31e6cb75c627c653652696d61e8de8

Affected versions: all before 0.26.0

Originally reported by Matteo Marini (Sapienza University of Rome)

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (3.9)