CVE-2024-1454

EUVD-2024-17206
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.4 LOW
PHYSICAL
HIGH
NONE
CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
Affected Products (NVD)
VendorProductVersion
opensc_projectopensc
𝑥
< 0.25.0
redhatenterprise_linux
7.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
opensc
bookworm
0.23.0-0.3+deb12u2
fixed
bullseye
vulnerable
bullseye (security)
0.21.0-1+deb11u1
fixed
buster
no-dsa
forky
0.26.1-3
fixed
sid
0.26.1-3
fixed
trixie
0.26.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
opensc
bionic
not-affected
focal
not-affected
jammy
not-affected
mantic
ignored
noble
not-affected
oracular
not-affected
trusty
ignored
xenial
not-affected
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
opensc
Amazon Linux 2023
0:0.24.0-1.amzn2023.0.3
fixed
opensc-debuginfo
Amazon Linux 2023
0:0.24.0-1.amzn2023.0.3
fixed
opensc-debugsource
Amazon Linux 2023
0:0.24.0-1.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
opensc
Azure Linux 3.0
0:0.25.1-3.azl3
fixed
CBL-Mariner 2.0
0:0.23.0-4.cm2
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2024-1454
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898
https://bugzilla.redhat.com/show_bug.cgi?id=2263929
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9
https://access.redhat.com/security/cve/CVE-2024-1454
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898
https://bugzilla.redhat.com/show_bug.cgi?id=2263929
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9
https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/