CVE-2018-16392

Vulnerability

In OpenSC before 0.19.0-rc1, the function tcos_select_file in libopensc/card-tcos.c contains several buffer overflows when processing responses from a TCOS card. The vulnerability is triggered when the smartcard returns malformed data, leading to out-of-bounds write. Affected versions include up to 0.18.0 and possibly earlier, fixed in 0.19.0-rc1 [4].

Exploitation

An attacker must supply a crafted smartcard that sends malicious responses to APDU commands. No authentication is required; the attacker only needs the victim to insert the malicious card into a system using OpenSC. The vulnerability is triggered automatically when OpenSC handles the card's response via the tcos_select_file function.

Impact

Successful exploitation could lead to a denial of service (application crash) due to memory corruption. The description also mentions "possibly have unspecified other impact", which may include arbitrary code execution, though this is not confirmed publicly [2].

Mitigation

Update to OpenSC version 0.19.0-rc1 or later, released on September 3, 2018 [4]. Users unable to update should avoid using untrusted smartcards. Red Hat Enterprise Linux users can apply RHSA-2019:2154 [1]. No workaround is available beyond upgrading.