CVE-2018-16391

Vulnerability

A buffer overflow vulnerability exists in the muscle_list_files() function in libopensc/card-muscle.c in OpenSC versions before 0.19.0-rc1. The function does not check the buffer length (bufLen) before copying data, leading to out-of-bounds writes when processing responses from a crafted smartcard. The issue was reported in the X41 advisory and fixed in commit 360e95d45ac4123255a4c796db96337f332160ad [2][3].

Exploitation

An attacker must physically deliver or trick a user into inserting a malicious smartcard into a reader connected to a system running an affected OpenSC version (e.g., 0.17.0). The smartcard sends crafted responses to APDU commands, triggering the buffer overflow in muscle_list_files() during file listing operations. No authentication or special privileges are required; the attack is carried out via normal card interaction [2].

Impact

Successful exploitation can cause a denial of service (application crash) due to memory corruption. The advisory also notes potential for unspecified other impact, as buffer overflows can sometimes be leveraged for code execution, though no such exploit is confirmed [1][2].

Mitigation

OpenSC fixed this issue in version 0.19.0-rc1, released on 2018-09-03 [4]. Red Hat Enterprise Linux users can apply RHSA-2019:2154 [1]. No workaround is available; users should upgrade to the patched version or later.