CVE-2023-2977

Vulnerability

A heap-based buffer over-read vulnerability exists in OpenSC, affecting the function cardos_have_verifyrc_package in src/pkcs15init/pkcs15-cardos.c. The flaw involves incorrect length calculation when the pointer p is moved after each sc_asn1_find_tag invocation during ASN.1 parsing. This occurs while scanning a response buffer for two specific tags (0xe1 and 0x01). The bug is present in versions of OpenSC prior to a fix that follows the pattern of commit 1252aca. The attacker must supply a smart card with a malformed ASN.1 context that triggers the miscalculation [1][3].

Exploitation

An attacker with physical access to a system or the ability to insert a malicious smart card can exploit this vulnerability. The attacker presents a crafted card that returns a specifically malformed ASN.1 structure in the response to the APDU command. The cardos_have_verifyrc_package function then processes the buffer, where the pointer p is advanced incorrectly, leading to a read beyond the allocated heap buffer. No authentication is required beyond card insertion; the attack can occur during normal card operations performed by the OpenSC library [1][3].

Impact

Successful exploitation results in a heap-based out-of-bounds read. This can cause a crash if AddressSanitizer (ASAN) is enabled during compilation, or lead to information disclosure of adjacent heap memory. In more severe scenarios, further damage or leakage of sensitive data is possible. The overall impact is limited to information disclosure and potential denial of service; Remote Code Execution (RCE) is not indicated [1][2].

Mitigation

A fix has been proposed and is expected to be included in a future OpenSC release, following the patch pattern referenced in the GitHub issue [3]. As of the publication date (2023-06-01), the vulnerability is marked NEW in Red Hat's Bugzilla, with a low severity, and no fixed version has been formally released [2]. Red Hat lists the bug as affecting OpenSC packages; users should monitor for updates from their distribution. No workaround is currently available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.