Skip to content

Commit daac1e6

Browse files
xhanulikxhanulik
committed
Add CVEs for uninitialized memory
1 parent 5aa3cb5 commit daac1e6

7 files changed

+192
-0
lines changed

‎CVE-2024-45615.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# [CVE-2024-45615](https://nvd.nist.gov/vuln/detail/CVE-2024-45615): Usage of uninitialized values in libopensc and pkcs15init
2+
3+
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. One is only relevant to handling the card enrollment using the pkcs15-init tool.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.).
7+
The uninitialized variables were reflected in the following functions:
8+
9+
- [cac_read_file](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac.c#L423)
10+
- calling function for reading files with uninitialized values for buffer and length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac.c#L389)
11+
- found via fuzz_card, fuzz_pkcs11, fuzz_pkcs15_crypt
12+
- [piv_get_challenge](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-piv.c#L4460)
13+
- uninitialized value later used in piv_get_challenge, since variables are not initialized by sc_asn1_read_tag (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-piv.c#L4459)
14+
- found via fuzz_pkcs11
15+
- [sc_asn1_decode_object_id](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/asn1.c#L838)
16+
- uninitialized values come from sc_pkcs15_get_name_from_dn function (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-cert.c#L172)
17+
- found via fuzz_pkcs11
18+
- [sc_pkcs15emu_sc_hsm_decode_cvc](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-sc-hsm.c#L421)
19+
- uninitialized values not filled by sc_asn1_read_tag function (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-sc-hsm.c#L389)
20+
- found via fuzz_pkcs15_crypt
21+
- do_init_app, [sc_pkcs15init_create_pin](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L1140)
22+
- uninitialized value comes from do_pin_flags (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/profile.c#L1812)
23+
- found via fuzz_pkcs15init
24+
25+
Affected versions: all before 0.26.0
26+
27+
Originally reported by Matteo Marini (Sapienza University of Rome)
28+
29+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2024-45616.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# [CVE-2024-45616](https://nvd.nist.gov/vuln/detail/CVE-2024-45616): Uninitialized values after incorrect check or usage of APDU response values in libopensc
2+
3+
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.
7+
The uninitialized variables were reflected in these functions:
8+
9+
- [cardos_match_card](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cardos.c#L136)
10+
- uninitialized APDU response buffer, unchecked response length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cardos.c#L136)
11+
- uninitialized value used later by cardos_match_card
12+
- found via fuzz_card, fuzz_pkcs11, fuzz_pkcs15_crypt, fuzz_pkcs15_decode
13+
- _itoa_word, called from [sc_hex_dump](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/log.c#L367)
14+
- the problem arose from cac_cac1_get_certificate function with wrong calculation of certificate length based on the APDU rseponse length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac1.c#L95-L100)
15+
- found via fuzz_card, fuzz_pkcs15_crypt, fuzz_pkcs15_decode
16+
- sc_bin_to_hex
17+
- the problem arose from auth_select_aid function unchecked SW1 and SW2 after querying for serial number (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-oberthur.c#L163)
18+
- found via fuzz_pkcs11, fuzz_pkcs15_encode
19+
- strcmp, called from sc_asn1_read_tag
20+
- the problem arose from gids_get_DO function with uncorrect setting of buffer length, when buffer filled with APDU response (https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/card-gids.c#L249-L253)
21+
- found via fuzz_pkcs15_decode,
22+
- [asn1_decode](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/asn1.c#L1740)
23+
- do_select not checking APDU response length before accesssing APDu response buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-mcrd.c#L590)
24+
- found via fuzz_pkcs11, fuzz_pkcs15_decode
25+
- [process_fcp](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-mcrd.c#L508)
26+
- do_select not checking APDU response length before accesssing APDu response buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-mcrd.c#L590)
27+
- fuzz_pkcs15_crypt
28+
- [dnie_process_fci](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-dnie.c#L2024)
29+
- dnie_compose_and_send_apdu lacks checking for APDU reponse length before accessing response (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-dnie.c#L1180)
30+
- found via fuzz_pkcs11, fuzz_pkcs15_crypt, fuzz_pkcs15_decode
31+
- [iso7816_process_fci](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iso7816.c#L463)
32+
- dnie_compose_and_send_apdu lacks checking for APDU reponse length before accessing response (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-dnie.c#L1180)
33+
- found via fuzz_pkcs15_encode
34+
- [sc_pkcs15init_parse_info](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L4564), [msc_extract_rsa_public_key](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/muscle.c#L620)
35+
- incorrect return of APDU reponse data length in msc_partial_read_object (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/muscle.c#L96)
36+
- uninitialized part of buffer after actual length accessed by sc_pkcs15init_parse_info
37+
- found via fuzz_pkcs11, fuzz_pkcs15init
38+
- [sc_bin_to_hex](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/sc.c#L155)
39+
- unchecked APDU response length when querying for serial number in auth_select_aid (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-oberthur.c#L163)
40+
- found via fuzz_pkcs15_crypt, fuzz_pkcs15init, fuzz_pkcs15_decode
41+
- [gids_read_masterfile](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-gids.c#L368)
42+
- the problem arose from gids_get_DO function with uncorrect setting of buffer length, when buffer filled with APDU response (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-gids.c#L249-L253)
43+
- [sc_bin_to_hex](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/sc.c#L155)
44+
- unchecked value of APDU response length in function entersafe_get_serialnr (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-entersafe.c#L1424)
45+
- found via fuzz_pkcs15_reader
46+
47+
Affected versions: all before 0.26.0
48+
49+
Originally reported by Matteo Marini (Sapienza University of Rome)
50+
51+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2024-45617.md

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# [CVE-2024-45617](https://nvd.nist.gov/vuln/detail/CVE-2024-45617): Uninitialized values after incorrect or missing checking return values of functions in libopensc
2+
3+
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
7+
The uninitialized variables were reflected in the following functions:
8+
9+
- bcdmp, called from [cac_list_compare_path](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac-common.c#L73)
10+
- in function cac_parse_aid, code accesses path buffer by cac_list_compare_path, when function for selecting file fails (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac.c#L1296)
11+
- found via fuzz_pkcs11, fuzz_pkcs15_decode
12+
- [cardos_lifecycle_get](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cardos.c#L1288)
13+
- incorrect check for error status leading into not propagating the error and usage of uninitialized value (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cardos.c#L1284)
14+
- found via fuzz_pkcs11
15+
- [sc_pkcs15_read_file](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15.c#L2535)
16+
- incorrect checking of return value in jpki_select_file (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-jpki.c#L196)
17+
- found via fuzz_pkcs15_encode
18+
19+
Affected versions: all before 0.26.0
20+
21+
Originally reported by Matteo Marini (Sapienza University of Rome)
22+
23+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2024-45618.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# [CVE-2024-45618](https://nvd.nist.gov/vuln/detail/CVE-2024-45618): Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
2+
3+
The reported issues are part of the card enrollment process using the pkcs15-init tool.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
7+
The uninitialized variables were reflected in the following functions:
8+
9+
- strlen, called from [set_string](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/sc.c#L252)
10+
- no checking of return value in sc_pkcs15emu_tcos_init_ex (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L536)
11+
- [sc_build_pin](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/sec.c#L281)
12+
- missing error handling in sc_pkcs15init_verify_secret (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L3831-L3841)
13+
- found via fuzz_pkcs15init
14+
- DES_set_key_unchecked, called from [openssl_enc](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-epass2003.c#L295)
15+
- missing error handling in sc_pkcs15init_verify_secret (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L3831-L3841)
16+
- found via fuzz_pkcs15init
17+
18+
Affected versions: all before 0.26.0
19+
20+
Originally reported by Matteo Marini (Sapienza University of Rome)
21+
22+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2024-45619.md

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# [CVE-2024-45619](https://nvd.nist.gov/vuln/detail/CVE-2024-45619): Incorrect handling length of buffers or files in libopensc
2+
3+
The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
When buffers are partially filled with data, uninitialized parts of the buffer can be incorrectly accessed.
7+
The uninitialized variables were reflected in the following functions:
8+
9+
- [insert_cert](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L70)
10+
- missing check for empty read file (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L65)
11+
- found via fuzz_pkcs11, fuzz_pkcs15_crypt, fuzz_pkcs15_decode, fuzz_pkcs15_encode
12+
- [asn1_encode_path](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/asn1.c#L1219)
13+
- function insert_cert accessing buffer after filled length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L70-L77)
14+
- found via fuzz_pkcs15_encode
15+
- [gemsafe_get_cert_len](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-gemsafeV1.c#L252)
16+
- accessing uninit(https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L763), [iasecc_se_parse](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L331)
17+
- missing checks for accessing data buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L764 and https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L322)
18+
- found via fuzz_pkcs15init
19+
- [setcos_generate_key](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-setcos.c#L511)
20+
- missing check for data length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-setcos.c#L507)
21+
- found via fuzz_pkcs15init
22+
- [sc_hsm_determine_free_id](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-sc-hsm.c#L144)
23+
- incorrect checking of file list length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-sc-hsm.c#L143)
24+
- found via fuzz_pkcs15initialized part of buffer without checking actual buffer length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-gemsafeV1.c#L180)
25+
- found via fuzz_pkcs15_crypt, fuzz_pkcs15_decode
26+
- [coolkey_rsa_op](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-coolkey.c#L1771)
27+
- missing check for length of buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-coolkey.c#L1770)
28+
- found via fuzz_pkcs15_reader
29+
30+
Affected versions: all before 0.26.0
31+
32+
Originally reported by Matteo Marini (Sapienza University of Rome)
33+
34+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2024-45620.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# [CVE-2024-45620](https://nvd.nist.gov/vuln/detail/CVE-2024-45620): Incorrect handling length of buffers or files in pkcs15init
2+
3+
The reported issues are part of the card enrollment process using the pkcs15-init tool.
4+
The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
5+
6+
When buffers are partially filled with data, uninitialized parts of the buffer can be incorrectly accessed.
7+
The uninitialized variables were reflected in the following functions:
8+
9+
- [starcos_write_pukey](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-starcos.c#L683)
10+
- lack of checking file length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-starcos.c#L671)
11+
- found via fuzz_pkcs15init
12+
- [iasecc_sdo_parse](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L763), [iasecc_se_parse](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L331)
13+
- missing checks for accessing data buffer (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L764 and https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/iasecc-sdo.c#L322)
14+
- found via fuzz_pkcs15init
15+
- [setcos_generate_key](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-setcos.c#L511)
16+
- missing check for data length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-setcos.c#L507)
17+
- found via fuzz_pkcs15init
18+
- [sc_hsm_determine_free_id](https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-sc-hsm.c#L144)
19+
- incorrect checking of file list length (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-sc-hsm.c#L143)
20+
- found via fuzz_pkcs15init
21+
22+
Affected versions: all before 0.26.0
23+
24+
Originally reported by Matteo Marini (Sapienza University of Rome)
25+
26+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎OpenSC-security-advisories.md

+7
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
Software often contains bugs, so does OpenSC. Be aware of the following security issues (in addition to overall [security considerations](Security-Considerations)) and upgrade to latest released version if needed.
44

5+
* 04.09.2024 Uninitialized memory issues have been identified in OpenSC
6+
* [CVE-2024-45615](CVE-2024-45615): Usage of uninitialized values in libopensc and pkcs15init
7+
* [CVE-2024-45616](CVE-2024-45616): Uninitialized values after incorrect check or usage of APDU response values in libopensc
8+
* [CVE-2024-45617](CVE-2024-45617): Uninitialized values after incorrect or missing checking return values of functions in libopensc
9+
* [CVE-2024-45618](CVE-2024-45618): Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
10+
* [CVE-2024-45619](CVE-2024-45619): Incorrect handling length of buffers or files in libopensc
11+
* [CVE-2024-45620](CVE-2024-45620): Incorrect handling of the length of buffers or files in pkcs15init*
512
* 13.02.2024 Heap use after free issue and vulnerability to Marvin attack have been identified in OpenSC
613
* Side-channel leaks while stripping encryption PKCS#1.5 padding [CVE-2023-5992|](CVE-2023-5992)
714
* Memory use after free in AuthentIC driver when updating token info [CVE-2024-1454](CVE-2024-1454)

0 commit comments

Comments
 (0)