CVE-2018-16427

Vulnerability

OpenSC versions before 0.19.0-rc1 contain multiple out-of-bounds read vulnerabilities in functions that parse responses from smartcards. These issues were identified through fuzzing and affect routines such as muscle_list_files() and decrypt_response() [2][3]. The library fails to validate buffer lengths before reading, leading to reads beyond allocated memory when processing malformed APDU responses.

Exploitation

An attacker must supply a crafted smartcard that sends specially crafted responses to APDU commands. No authentication or special privileges are required; the card is inserted into a reader and the host software processes the response. By providing unexpected data lengths or malformed TLV structures, the attacker can trigger out-of-bounds reads in the OpenSC library.

Impact

Successful exploitation results in a crash of the OpenSC library or any application using it (e.g., smart card authentication tools). This constitutes a denial-of-service condition. No code execution or privilege escalation is described in the available references.

Mitigation

The vulnerabilities are fixed in OpenSC version 0.19.0-rc1 [4]. Red Hat has released an advisory (RHSA-2019:2154) for Red Hat Enterprise Linux [1]. Users should update to the patched version. No workaround is available.