CVE-2021-42780

Vulnerability

OpenSC before version 0.22.0 contains a use-after-return bug in the insert_pin function in tcos.c [1]. The function reads a record from a smart card and iterates over its TLV data without always verifying that the buffer index remains within bounds [1]. When processing malformed or specially crafted card responses, the code may continue reading past the record boundary, leading to a use of a stack pointer that has already been returned or freed [1][3].

Exploitation

An attacker must have the ability to present a malicious smart card or emulate an authentication service that supplies crafted APDU responses to a system using OpenSC [1][3]. No special privileges on the target system are needed beyond physical or proximity access to a card reader, or the ability to deliver a crafted card image via a virtual smart card. The attacker does not need to authenticate to the system beforehand [3].

Impact

Successful exploitation causes the program using OpenSC to crash, resulting in a denial of service (DoS) [1][2][3]. The referenced sources do not describe a path to privilege escalation or information disclosure; the impact is limited to availability loss [3].

Mitigation

The vulnerability has been fixed in OpenSC 0.22.0 [1][2]. Users should upgrade to this version or later [2]. The Gentoo Security Advisory (GLSA 202209-03) states there is no known workaround; the only remediation is to update the library [2]. The issue is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.