CVE-2018-16420

Vulnerability

A buffer overflow vulnerability exists in the decrypt_response function in libopensc/card-epass2003.c of OpenSC versions before 0.19.0-rc1 [1][2]. The function does not properly check the length of the decrypted response, allowing an attacker to overflow a buffer when processing crafted responses from an ePass 2003 card [3].

Exploitation

An attacker needs physical access to insert a maliciously crafted smartcard or the ability to supply malformed responses to APDU commands. The attack does not require authentication or user interaction beyond inserting the card [2]. By sending oversized or specially crafted ciphertext, the attacker triggers a buffer overflow in the decrypt_response function.

Impact

Successful exploitation can cause a denial of service (application crash) due to memory corruption. The description also notes the possibility of unspecified other impact, which may include arbitrary code execution, although this has not been confirmed [1][2].

Mitigation

The vulnerability is fixed in OpenSC version 0.19.0-rc1 [4]. Red Hat also released an erratum (RHSA-2019:2154) addressing this issue [1]. Users should upgrade to the patched version. No known workarounds are available.