Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keys

Vulnerability

An out-of-bounds read vulnerability exists in the MyEID driver of OpenSC when handling symmetric key encryption. The flaw is triggered during processing of APDU responses from a smart card or USB device. Affected versions include OpenSC before 0.23.0-3.el9_3 on Red Hat Enterprise Linux and upstream versions before 0.24.0 [1][4].

Exploitation

An attacker must have physical access to the target computer and a specially crafted USB device or smart card. By inserting the malicious device, the attacker can send manipulated APDU responses that trigger the out-of-bounds read in the MyEID driver [2].

Impact

Successful exploitation allows the attacker to read out-of-bounds memory, potentially disclosing sensitive data such as cryptographic keys or other confidential information. This could lead to unauthorized access to the system's security assets [2].

Mitigation

Red Hat has released a fix in opensc-0.23.0-3.el9_3 as part of RHSA-2023:7879 [1]. Upstream, the issue is resolved in OpenSC version 0.24.0 [3]. Users should update to the latest patched version. No workaround is documented.