CVE-2020-26570

Vulnerability

A heap-based buffer overflow exists in the sc_oberthur_read_file function of OpenSC's Oberthur smart card software driver, affecting versions before 0.21.0-rc1 [1]. The vulnerability occurs because the loop reading records does not check that the record index rec stays within the bounds of file->record_count. When processing a malformed smart card with a record count larger than expected, the write operation *out + offs + 2 can overflow the heap-allocated buffer *out [3].

Exploitation

An attacker with physical access to the smart card slot can insert a specially crafted card that induces an out-of-bounds write. No authentication is required beyond card insertion and library interaction. The vulnerable code path is reachable when OpenSC attempts to read the file structure of the card via the Oberthur driver, which is commonly triggered by card enumeration or PIN verification operations [2].

Impact

Successful exploitation can corrupt heap memory, potentially leading to denial of service (crash) or arbitrary code execution within the context of the process using OpenSC. The impact is limited to systems where OpenSC is used with Oberthur smart cards, and the attacker must have physical proximity to insert the malicious card [1][2].

Mitigation

The vulnerability is fixed in OpenSC version 0.21.0-rc1, released on 2020-11-24 [1]. Users should upgrade to this version or later. No workarounds are available; physical access control to smart card readers is the only partial mitigation for unpatched systems [2].