PT-2023-8908 · Opensc+9 · Opensc+9

Tej Rathi · Publicado 2023-09-25 · Atualizado 2025-04-09 · CVE-2023-40661

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description The issue is related to several memory vulnerabilities within the OpenSC packages, specifically in the card enrollment process using pkcs15-init. An attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise of key generation, certificate loading, and other card management operations during enrollment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALSA-2023:7876

ALSA-2023:7879

ALSA-2023_7876

ALSA-2023_7879

ALT-PU-2023-8056

ALT-PU-2023-8077

ALT-PU-2023-8185

ALT-PU-2024-7018

AZL-31944

AZL-35075

BDU:2024-02588

CESA-2023_7876

CVE-2023-40661

DLA-3668-1

DLA-4004-1

OPENSUSE-SU-2024:13314-1

RHSA-2023:7876

RHSA-2023:7879

RHSA-2023_7876

RHSA-2023_7879

ROSA-SA-2025-2580

SUSE-SU-2023:4065-1

SUSE-SU-2023:4089-1

SUSE-SU-2023:4104-1

USN-7346-1

USN-7346-2

USN-7346-3

Produtos afetados

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Red Os

Suse

Ubuntu

Referências · 86

• 🔥 https://github.com/OpenSC/OpenSC/wiki/CVE-2023-40661 · Exploit
• https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651 · Nota
• https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories · Aviso do Fabricante
• https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1 · Nota
• https://linux.oracle.com/errata/ELSA-2023-7876.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-45618 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-7346-3 · Aviso do Fabricante
• https://t.me/cibsecurity/73627 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2021-42782 · Nota
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://bugzilla.redhat.com/2240913 · Nota
• https://ubuntu.com/security/CVE-2023-5992 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-45617 · Aviso do Fabricante
• https://errata.almalinux.org/8/ALSA-2023-7876.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:7879 · Aviso do Fabricante