Bugzilla – Bug 1215762
VUL-0: CVE-2023-40660: opensc: PIN bypass when card tracks its own login state
Last modified: 2023-10-23 07:00:50 UTC
When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its internals. This is dangerous for OS logon/screen unlock and small tokens that are plugged permanently to the computer. The bypass was removed and OpenSC implemented explicit logout for most of the card drivers to prevent leaving unattended logged-in tokens Affected versions: OpenSC 0.17.0 - 0.23.0 https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651 https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-40660 https://bugzilla.redhat.com/show_bug.cgi?id=2240912
Patches were backported and are ready in my home branch. I will submit them once I finish CVE-2023-40661 Codestream SUSE:SLE-15:Update/opensc is affected but no longer supported.
Submitted here: > openSUSE:Factory https://build.opensuse.org/request/show/1116670 > SLE-15-SP4_Update https://build.suse.de/request/show/310044 > SLE-15-SP1_Update https://build.suse.de/request/show/310046 ALP will be submitted once above request will be accepted in Factory.
> Codestream Request > ------------------------------------------------------------------------ > openSUSE:Factory https://build.opensuse.org/request/show/1116670 > SUSE:ALP:Source:Standard:1.0 https://build.suse.de/request/show/310145 > SLE-15-SP4_Update https://build.suse.de/request/show/310044 > SLE-15-SP1_Update https://build.suse.de/request/show/310046 > SLE-12_Update not affected Assigning back to security team
SUSE-SU-2023:4089-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1215761, 1215762 CVE References: CVE-2023-40660, CVE-2023-40661 Sources used: SUSE Linux Enterprise Micro for Rancher 5.3 (src): opensc-0.22.0-150400.3.6.1 SUSE Linux Enterprise Micro 5.3 (src): opensc-0.22.0-150400.3.6.1 SUSE Linux Enterprise Micro for Rancher 5.4 (src): opensc-0.22.0-150400.3.6.1 SUSE Linux Enterprise Micro 5.4 (src): opensc-0.22.0-150400.3.6.1 SUSE Linux Enterprise Micro 5.5 (src): opensc-0.22.0-150400.3.6.1 Basesystem Module 15-SP4 (src): opensc-0.22.0-150400.3.6.1 Basesystem Module 15-SP5 (src): opensc-0.22.0-150400.3.6.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4104-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1215761, 1215762 CVE References: CVE-2023-40660, CVE-2023-40661 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): opensc-0.19.0-150100.3.25.1 SUSE Manager Proxy 4.2 (src): opensc-0.19.0-150100.3.25.1 SUSE Manager Retail Branch Server 4.2 (src): opensc-0.19.0-150100.3.25.1 SUSE Manager Server 4.2 (src): opensc-0.19.0-150100.3.25.1 SUSE Enterprise Storage 7.1 (src): opensc-0.19.0-150100.3.25.1 SUSE CaaS Platform 4.0 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Micro 5.1 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Micro 5.2 (src): opensc-0.19.0-150100.3.25.1 SUSE Linux Enterprise Micro for Rancher 5.2 (src): opensc-0.19.0-150100.3.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.