Bug 1104809 - (CVE-2018-14779) VUL-1: CVE-2018-14779: yubico-piv-tool: Out of Bounds Write via Malicious APDU
(CVE-2018-14779)
VUL-1: CVE-2018-14779: yubico-piv-tool: Out of Bounds Write via Malicious APDU
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/212725/
CVSSv3:SUSE:CVE-2018-14779:7.1:(AV:P/...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-08-14 14:13 UTC by Marcus Meissner
Modified: 2019-07-18 06:18 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-08-14 14:13:36 UTC
CVE-2018-14779

X41 D-Sec GmbH Security Advisory: X41-2018-001

Multiple Vulnerabilities in Yubico Piv
======================================


Overview
- --------
Confirmed Affected Versions: 1.5.0
Confirmed Patched Versions: 1.6.0
Vendor: Yubico
Vendor URL: https://www.yubico.com/
Vendor Advisory URL: https://www.yubico.com/support/security-advisories
Credit: X41 D-Sec GmbH, Eric Sesterhenn
Status: Public
Advisory-URL:
https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/


Summary and Impact
- ------------------
A buffer overflow and an out of bounds memory read were identified in
the yubico-piv-tool-1.5.0, these can be triggered by a malicious token.
X41 did not perform a full test or audit on the software.


Product Description
- -------------------
YubiKey 4, YubiKey 4 Nano, YubiKey 4C, YubiKey 4C Nano, and YubiKey
NEO provide Smart Card functionality based on the Personal Identity
Verification (PIV) interface specified in NIST SP 800-73,
“Cryptographic Algorithms and Key Sizes for PIV.”

Out of Bounds Write via Malicious APDU
======================================
Severity Rating: High
Vector: APDU Response
CVE: CVE-2018-14779
CWE: 120
CVSS Score: 7.1 (High)
CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H


Summary and Impact
- ------------------
File lib/ykpiv.c contains the following code in function
ykpiv_transfer_data()

{% highlight c %}
    if(*outlen + recvlen - 2 > maxout) {
      fprintf(stderr, "Output buffer to small, wanted to write %lu,
max was %lu.", *outlen + recvlen - 2, maxout);
    }
    if(outdata) {
      memcpy(outdata, data, recvlen - 2);
      outdata += recvlen - 2;
      *outlen += recv_len - 2;
    }
{% endhighlight %}

It is clearly checked whether the buffer is big enough to hold the
data copied using memcpy(), but no error handling happens to avoid the
memcpy() in such cases. This code path can be triggered with malicious
data coming from a smartcard.


Workarounds
- -----------
None

Out of Bounds Read via malicious APDU
=====================================
Severity Rating: LOW
Vector: APDU Response
CVE: CVE-2018-14780
CWE: 125
CVSS Score: 2.2 (Low)
CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N


Summary and Impact
- ------------------
File lib/ykpiv.c contains the following code in function
_ykpiv_fetch_object()

{% highlight c %}
if(sw == SWSUCCESS) {
  sizet outlen;
  int offs = ykpivgetlength(data + 1, &outlen);
  if(offs == 0) {
    return YKPIVSIZEERROR;
  }
  memmove(data, data + 1 + offs, outlen);
  *len = outlen;
  return YKPIVOK;
} else {
  return YKPIVGENERICERROR;
}
{% endhighlight %}

In the end, a memmove() occurs with a length retrieved from APDU data.
This length is not checked if it is outside of the APDU data
retrieved. Therefore the memmove() could copy bytes behind the
allocated data buffer into this buffer.


Workarounds
- -----------
None

Timeline
========
2018-02-03 Issues found
2018-05-22 Vendor contacted
2018-05-22 Vendor reply
2018-06-05 Requesting technical feedback from the vendor
2018-06-06 Vendor confirms bug
2018-08-01 CVE ID requested
2018-08-02 CVE ID assigned
2018-08-08 Patched version released by vendor
2018-08-11 Advisory released
Comment 1 Marcus Meissner 2018-08-14 14:17:42 UTC
only CVE-2018-14779 in here, other issue is in another bug
Comment 3 Karol Babioch 2018-08-28 11:45:26 UTC
Fixed for all supported codestreams:

https://build.opensuse.org/request/show/631969
https://build.suse.de/request/show/171123
https://build.suse.de/request/show/171122

Re-assigning back to security-team.
Comment 4 Swamp Workflow Management 2018-08-28 12:30:06 UTC
This is an autogenerated message for OBS integration:
This bug (1104809) was mentioned in
https://build.opensuse.org/request/show/631973 42.3 / yubico-piv-tool
Comment 5 Swamp Workflow Management 2018-09-05 13:12:21 UTC
openSUSE-SU-2018:2623-1: An update that fixes two vulnerabilities is now available.

Category: security (low)
Bug References: 1104809,1104811
CVE References: CVE-2018-14779,CVE-2018-14780
Sources used:
openSUSE Leap 42.3 (src):    yubico-piv-tool-0.1.6-7.3.1
Comment 7 Swamp Workflow Management 2019-04-30 19:18:36 UTC
SUSE-SU-2019:1123-1: An update that fixes two vulnerabilities is now available.

Category: security (low)
Bug References: 1104809,1104811
CVE References: CVE-2018-14779,CVE-2018-14780
Sources used:
SUSE Linux Enterprise Module for Basesystem 15 (src):    yubico-piv-tool-1.5.0-3.3.33

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2019-05-08 13:13:56 UTC
openSUSE-SU-2019:1341-1: An update that fixes two vulnerabilities is now available.

Category: security (low)
Bug References: 1104809,1104811
CVE References: CVE-2018-14779,CVE-2018-14780
Sources used:
openSUSE Leap 15.0 (src):    yubico-piv-tool-1.5.0-lp150.2.3.1
Comment 9 Marcus Meissner 2019-07-18 06:18:48 UTC
released