CVE-2021-42781

Vulnerability

Heap buffer overflow issues exist in OpenSC versions before 0.22.0 in the file pkcs15-oberthur.c. The vulnerabilities occur in functions sc_pkcs15emu_oberthur_add_cert, sc_pkcs15emu_oberthur_add_data, and sc_pkcs15emu_oberthur_add_pubkey when parsing certificate, data, and public key information from Oberthur smart cards. The code does not properly validate the lengths of fields such as labels, IDs, and OIDs before reading them, leading to out-of-bounds reads.

Exploitation

An attacker would need to present a crafted Oberthur smart card or emulated card to a system using the vulnerable OpenSC library. The library reads card files during PKCS#15 initialization. No special privileges beyond physical or logical access to supply the malicious card data are required. The exploitation is triggered when the library processes the malicious card data, causing heap buffer overflows.

Impact

Successful exploitation can lead to a heap buffer overflow, potentially causing a program crash (denial of service). In some cases, it might be possible to achieve further memory corruption, but the primary documented impact is a crash of the application using the OpenSC library.

Mitigation

The vulnerabilities are fixed in OpenSC version 0.22.0. Patches are available in the commits [1], [2], [3], and [4]. Users should upgrade to OpenSC 0.22.0 or later. No workaround is provided for earlier versions.