CVE-2018-16422

Vulnerability

A single-byte buffer overflow exists in the sc_pkcs15emu_esteid_init function in libopensc/pkcs15-esteid.c in OpenSC before version 0.19.0-rc1 [1][4]. When processing specially crafted responses from an Esteid smartcard, the code writes one byte beyond the allocated buffer, leading to memory corruption. The vulnerability affects all OpenSC releases prior to 0.19.0-rc1 [4].

Exploitation

An attacker with physical access or the ability to supply a maliciously crafted Esteid smartcard to a victim's system can trigger this overflow by sending a malformed response to an APDU command [2]. No authentication is required beyond the smartcard being inserted and the OpenSC library processing the card's data.

Impact

Successfully exploiting the buffer overflow can cause a denial of service via application crash. The advisory notes that unspecified other impact may be possible, potentially including arbitrary code execution depending on memory layout and defenses [2]. The vulnerability is classified as a CWE-122 (heap-based buffer overflow).

Mitigation

The vulnerability is fixed in OpenSC version 0.19.0-rc1, released on 2018-09-04 [4]. Red Hat Enterprise Linux users can apply RHSA-2019:2154 to update their OpenSC packages [1]. No workaround is available for unpatched versions; users should upgrade immediately. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.