CVE-2023-4535

EUVD-2023-54390
An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.5 MEDIUM
PHYSICAL
HIGH
NONE
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
redhatCNA
4.5 MEDIUM
PHYSICAL
HIGH
NONE
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
opensc_projectopensc
0.23.0
opensc_projectopensc
0.23.0:rc1
opensc_projectopensc
0.23.0:rc2
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opensc
bookworm
0.23.0-0.3+deb12u1
fixed
bullseye
0.21.0-1
not-affected
bullseye (security)
0.21.0-1+deb11u1
fixed
buster
not-affected
sid
0.26.0-1
fixed
trixie
0.26.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensc
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
ignored
xenial
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2023:7879
https://access.redhat.com/security/cve/CVE-2023-4535
https://bugzilla.redhat.com/show_bug.cgi?id=2240914
https://github.com/OpenSC/OpenSC/commit/f1993dc4e0b33050b8f72a3558ee88b24c4063b2
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
https://access.redhat.com/errata/RHSA-2023:7879
https://access.redhat.com/security/cve/CVE-2023-4535
https://bugzilla.redhat.com/show_bug.cgi?id=2240914
https://github.com/OpenSC/OpenSC/commit/f1993dc4e0b33050b8f72a3558ee88b24c4063b2
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/