CVE-2018-16421

Vulnerability

A buffer overflow vulnerability exists in the cac_get_serial_nr_from_CUID function in libopensc/card-cac.c in OpenSC versions before 0.19.0-rc1 [2]. The function copies attacker-controlled data into a fixed-size buffer without proper bounds checking, leading to a stack-based buffer overflow [3]. This issue is part of a series of buffer overflow and out-of-bounds access vulnerabilities identified by X41 D-Sec [2].

Exploitation

An attacker must supply a crafted smartcard or a device emulating one that sends a malformed response to an APDU command [2]. No prior authentication or special privileges are required. When the victim's system reads the card, the vulnerable code path is triggered, causing the overflow [3].

Impact

Successful exploitation causes a denial of service (application crash) and, depending on the memory layout, may allow arbitrary code execution [2]. The CVSS score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H [1].

Mitigation

The vulnerability is fixed in OpenSC version 0.19.0-rc1 [4]. Users should update to this version or later. Red Hat Enterprise Linux users can apply the update via RHSA-2019:2154 [1]. No workaround is available; upgrading is the only mitigation.