Bugzilla – Bug 1214591
VUL-0: CVE-2021-34193: opensc: stack overflow via crafted responses to APDUs
Last modified: 2023-11-08 10:23:01 UTC
CVE-2021-34193 Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs. Currently there is no issue listed upstream at: https://github.com/OpenSC/OpenSC References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34193 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27719 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28855 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29912 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30800 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31448 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31540 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32149 https://www.cve.org/CVERecord?id=CVE-2021-34193
Question to upstream about the situation: https://github.com/OpenSC/OpenSC/issues/2841
As discussed upstream, this issue is duplicate for following CVEs: CVE-2021-42778 opensc: Heap double free in sc_pkcs15_free_tokeninfo CVE-2021-42779 opensc: Heap use after free in sc_file_valid CVE-2021-42780 opensc: Use after return in insert_pin function CVE-2021-42781 opensc: Heap buffer overflow in pkcs15-oberthur.c CVE-2021-42782 opensc: Stack buffer overflow issues in various places All of them are already fixed in our codestreams so I suggest to close this issue as invalid. Upstream comment: > https://github.com/OpenSC/OpenSC/issues/2841#issuecomment-1700853357