Sign In
Advisories

OpenSC < 0.27.0-rc1 Stack Buffer Overflow via piv_process_history() in card-piv.c

Go Back
severity
low
date
Affecting

  • OpenSC < 0.27.0-rc1

  • OpenSC < 3f24f0b

CWE
  • CWE-121 Stack-based Buffer Overflow
CVSS
1
CVSS V4 Vector
CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Credit
Nicholas Carlini of Anthropic
Description
OpenSC before 0.27.0-rc1, fixed in commit 3f24f0b, contains a stack buffer overflow vulnerability in piv_process_history() in src/libopensc/card-piv.c that allows physically present attackers to trigger memory corruption by presenting a crafted PIV smart card or USB device returning a URL field longer than 118 bytes in the Key History Object ASN.1 response.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo