CVE-2019-15945

Vulnerability

CVE-2019-15945 is an out-of-bounds access vulnerability in the ASN.1 Bitstring decoding function decode_bit_string in libopensc/asn1.c of OpenSC [1]. The flaw exists in versions before 0.20.0-rc1, where insufficient bounds checking on the input buffer leads to reading beyond the allocated memory [4]. The vulnerability was discovered through fuzz testing via OSS-Fuzz [2].

Exploitation

An attacker would need to supply a malformed ASN.1 Bitstring to an application using the vulnerable OpenSC library [1]. This could be achieved by presenting a crafted smart card or providing a malicious certificate/security object. No authentication is required; the attacker only needs to trigger the decoding routine with the crafted input [4]. The specific sequence involves the function first checking the input length but not properly using that check to prevent an out-of-bounds read when processing the bits [4].

Impact

Successful exploitation can lead to an out-of-bounds memory access, potentially resulting in information disclosure or a denial-of-service condition [1][4]. The confidentiality impact is considered low, and the integrity impact is none; however, the availability impact could be high if the read causes a crash [1]. The attacker does not gain code execution control from this read-only out-of-bounds access.

Mitigation

OpenSC version 0.20.0, released on December 29, 2019, includes the fix [2]. The patch moves the out-of-bounds read inside the proper length check and initializes the output buffer earlier [4]. Users should update to OpenSC 0.20.0 or later. No workaround is available for earlier versions [2].