OpenSC up to 0.18.x HSM Card pkcs15-sc-hsm.c sc_pkcs15emu_sc_hsm_init double free

Summaryinfo

A vulnerability classified as problematic has been found in OpenSC up to 0.18.x. This affects the function sc_pkcs15emu_sc_hsm_init of the file libopensc/pkcs15-sc-hsm.c of the component HSM Card Handler. Performing a manipulation results in double free. This vulnerability is cataloged as CVE-2018-16425. The attack may be carried out on the physical device. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenSC up to 0.18.x. It has been classified as problematic. This affects the function sc_pkcs15emu_sc_hsm_init of the file libopensc/pkcs15-sc-hsm.c of the component HSM Card Handler. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on availability. The summary by CVE is:

A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

The bug was discovered 08/14/2018. The weakness was shared 09/04/2018 (Website). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-16425 since 09/03/2018. The exploitability is told to be easy. An attack has to be approached locally. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 20 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 118881 (openSUSE Security Update : opensc (openSUSE-2018-1385)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277562 (Fedora Security Update for opensc (FEDORA-2018-d0dff2abaa)).

Upgrading to version 0.19.0-rc1 eliminates this vulnerability. A possible mitigation has been published 3 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118881). The entries VDB-123545 and VDB-123548 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• OpenSC

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18

License

• open-source

Website

• Product: https://github.com/OpenSC/OpenSC/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion