CVE-2018-16419

Vulnerability

A buffer overflow vulnerability exists in the read_public_key function in tools/cryptoflex-tool.c of OpenSC before version 0.19.0-rc1. When handling responses from a Cryptoflex card, insufficient bounds checking can lead to a buffer overflow. This affects OpenSC versions prior to the fix [1][2].

Exploitation

An attacker with access to a smartcard can exploit this vulnerability by supplying a crafted smartcard that sends malformed responses to APDU commands. No special privileges beyond physical or logical access to the smartcard reader are required. The attacker simply needs to present the malicious card to a system running the vulnerable OpenSC version and trigger the cryptoflex-tool read_public_key operation [2].

Impact

Successful exploitation can result in a denial of service (application crash) or potentially other unspecified impacts, such as arbitrary code execution. The vulnerability is an out-of-bounds write that can corrupt memory, potentially allowing the attacker to compromise the confidentiality, integrity, or availability of the system [1][2].

Mitigation

The vulnerability is fixed in OpenSC version 0.19.0-rc1, released on 2018-09-04 [4]. Red Hat issued an erratum RHSA-2019:2154 in September 2019 [1]. Users should update to the patched version. There is no known workaround for unpatched versions.