PT-2021-17330 · Yubico · Yubihsm-Shell

Christian Reitter · Published 2021-03-04 · Updated 2021-03-26 · CVE-2021-27217

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Yubico yubihsm-shell versions 2.0.0 through 2.0.3

Description: An issue was discovered in the send secure msg() function. The function does not correctly validate the embedded length field of an authenticated message received from the device. Out-of-bounds reads performed by aes remove padding() can crash the running process, depending on the memory layout. This could be used by an attacker to cause a client-side denial of service. The yubihsm-shell project is included in the YubiHSM 2 SDK product.

Recommendations: For versions 2.0.0 through 2.0.3, as a temporary workaround, consider disabling the send secure msg() function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-27217

Affected Products

Yubihsm-Shell

References · 6

• 🔥 https://blog.inhq.net/posts/yubico-libyubihsm-vuln2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-27217 · Security Note
• https://yubico.com/support/security-advisories/ysa-2021-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27217 · Vendor Advisory
• https://github.com/Yubico/yubihsm-shell/releases · Note
• https://t.me/cvenotify/10881 · Telegram Post