CVE-2020-26572

Vulnerability

A stack-based buffer overflow exists in the tcos_decipher function of the TCOS smart card software driver in OpenSC versions before 0.21.0-rc1 [3]. The vulnerability occurs when copying ciphertext data into a fixed-size stack buffer (sbuf) without verifying that the length (crgram_len) does not exceed the buffer size minus one [3]. This leads to a buffer overflow when crgram_len is larger than the buffer can hold.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted cryptographic input to the tcos_decipher function, typically through a malicious smart card or via any interface that supplies data to the OpenSC driver [3]. No authentication is required if the attacker can control the input data. The exploitation does not require user interaction beyond inserting a card or processing the input.

Impact

Successful exploitation results in a stack-based buffer overflow, which can cause a crash (denial of service) or potentially allow arbitrary code execution with the privileges of the process using OpenSC [3]. This could lead to a full system compromise if the driver runs with elevated permissions.

Mitigation

The vulnerability is fixed in OpenSC version 0.21.0-rc1 and later [1][3]. Users should upgrade to OpenSC 0.21.0 or later. There are no known workarounds; updating is the recommended mitigation.