CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
52.1%
A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpiv_transfer_data()
: {% highlight c %} if(*out_len + recv_len - 2 > max_out) { fprintf(stderr, “Output buffer to small, wanted to write %lu, max was %lu.”, *out_len + recv_len - 2, max_out); } if(out_data) { memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len += recv_len - 2; } {% endhighlight %} – it is clearly checked whether the buffer is big enough to hold the data copied using memcpy()
, but no error handling happens to avoid the memcpy()
in such cases. This code path can be triggered with malicious data coming from a smartcard.
Vendor | Product | Version | CPE |
---|---|---|---|
yubico | piv_manager | * | cpe:2.3:a:yubico:piv_manager:*:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2 | cpe:2.3:a:yubico:piv_manager:1.4.2:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2b | cpe:2.3:a:yubico:piv_manager:1.4.2b:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2c | cpe:2.3:a:yubico:piv_manager:1.4.2c:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2d | cpe:2.3:a:yubico:piv_manager:1.4.2d:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2e | cpe:2.3:a:yubico:piv_manager:1.4.2e:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2f | cpe:2.3:a:yubico:piv_manager:1.4.2f:*:*:*:*:*:*:* |
yubico | piv_manager | 1.4.2g | cpe:2.3:a:yubico:piv_manager:1.4.2g:*:*:*:*:*:*:* |
yubico | piv_tool | * | cpe:2.3:a:yubico:piv_tool:*:*:*:*:*:*:*:* |
yubico | smart_card_minidriver | * | cpe:2.3:a:yubico:smart_card_minidriver:*:*:*:*:*:*:*:* |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
PHYSICAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
52.1%