Out-of-bounds Read

2023-10-0612:09:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

out-of-bounds read

libopensc.so

card-myeid.c

symmetric keys

maliciously crafted responses

apdu

information security

4.5 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

25.1%

JSON

libopensc.so is vulnerable to out-of-bounds reads. The vulnerability exists in card-myeid.c because it does not properly validate symmetric keys, which allows an attacker to send maliciously crafted responses to the APDU and read information outside of the intended range.

CPENameOperatorVersion
libopensc.sole8.1.0
opensc:sideq0.22.0-1
opensc:sideq0.20.0-4
opensc:edgeeq0.20.0-r0
opensc:edgeeq0.23.0-r0
opensc:edgeeq0.20.0-r1
opensc:edgeeq0.22.0-r3
opensc:edgeeq0.21.0-r0
opensc:edgeeq0.22.0-r0
opensc:edgeeq0.22.0-r1

Name	Operator	Version
libopensc.so	le	8.1.0
opensc:sid	eq	0.22.0-1
opensc:sid	eq	0.20.0-4
opensc:edge	eq	0.20.0-r0
opensc:edge	eq	0.23.0-r0
opensc:edge	eq	0.20.0-r1
opensc:edge	eq	0.22.0-r3
opensc:edge	eq	0.21.0-r0
opensc:edge	eq	0.22.0-r0
opensc:edge	eq	0.22.0-r1