CVE-2020-26571

Vulnerability

A stack-based buffer overflow exists in the sc_pkcs15emu_gemsafeGPK_init function of the GemSafe GPK smart card software driver in OpenSC versions prior to 0.21.0-rc1. The vulnerability is triggered during PKCS#15 emulation when processing maliciously crafted smart card responses, potentially allowing an attacker to overwrite stack memory.

Exploitation

An attacker must have local access to a system with a vulnerable OpenSC installation and be able to insert a specially crafted smart card or provide malicious data that the driver will process via sc_pkcs15emu_gemsafeGPK_init. No authentication is needed beyond the ability to present the smart card to the reader; the overflow occurs during initial card response parsing.

Impact

Successful exploitation results in stack-based buffer overflow, which can lead to arbitrary code execution with the privileges of the process using OpenSC (often root or high-integrity user). This can allow an attacker to fully compromise the host system, including reading sensitive data from secure elements or executing arbitrary commands.

Mitigation

The vulnerability is fixed in OpenSC version 0.21.0-rc1 and later, as released on November 24, 2020 [1]. Users are advised to upgrade immediately. No workarounds are available; the fix is included in the 0.21.0 release [1].