CVE-2018-16426

Vulnerability

The vulnerability is an endless recursion in iasecc_select_file() in libopensc/card-iasecc.c in OpenSC before version 0.19.0-rc1 [1][3]. When processing a crafted response from an IAS-ECC smartcard, the function recursively selects the MF without checking the path type, leading to infinite recursion [4].

Exploitation

An attacker with physical access supplies a malicious smartcard that returns a malformed response to an APDU command. The OpenSC library, when handling the response, enters an infinite loop in iasecc_select_file(). No authentication or special privileges are required [1][2].

Impact

Successful exploitation causes a denial of service (DoS) by hanging or crashing the OpenSC library. Applications using the library (e.g., for authentication or encryption) become unavailable. No data is compromised [1].

Mitigation

The fix was included in OpenSC 0.19.0-rc1 [3]. Red Hat Enterprise Linux users can apply RHSA-2019:2154 [1]. No workaround exists for unpatched versions.