Bug 1219868 (CVE-2024-1454) - VUL-0: CVE-2024-1454: opensc: use after free in AuthentIC driver when updating token info
Summary: VUL-0: CVE-2024-1454: opensc: use after free in AuthentIC driver when updatin...
Status: RESOLVED FIXED
Alias: CVE-2024-1454
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/393763/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-1454:4.5:(AV:P...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-13 08:46 UTC by SMASH SMASH
Modified: 2024-04-19 08:26 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-02-13 08:46:46 UTC 
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-1454
https://bugzilla.redhat.com/show_bug.cgi?id=2263929
https://www.cve.org/CVERecord?id=CVE-2024-1454
https://access.redhat.com/security/cve/CVE-2024-1454
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9
Comment 1 Carlos López 2024-02-13 08:49:09 UTC 
Affects openSUSE:Factory and SUSE:ALP:Source:Standard:1.0
Comment 2 Martin Schreiner 2024-02-20 17:34:44 UTC 
I'm on it.
Comment 3 Martin Schreiner 2024-03-07 12:43:15 UTC 
I'm marking this as solved.

We have the bugfix patch, it's been accepted on openSUSE:Factory, and I've submitted to ALP.

ALP
https://build.suse.de/request/show/323543

openSUSE:Factory
https://build.opensuse.org/package/rdiff/openSUSE:Factory/opensc?linkrev=base&rev=56
Comment 6 Carlos López 2024-04-19 08:26:50 UTC 
Everything should be released. Closing.