PT-2021-19727 · Yubico · Yubihsm-Shell

Christian Reitter · Published 2021-05-10 · Updated 2021-05-19 · CVE-2021-32489

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AC:H/AV:N/A:H/C:N/I:N/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: Yubico yubihsm-shell versions 2.0.0 through 2.0.3

Description: An issue was discovered in the send secure msg() function. The function does not correctly validate the embedded length field of an authenticated message received from the device, which can trigger an integer overflow. This causes CRYPTO cbc128 decrypt (in OpenSSL) to encounter an undersized buffer and experience a segmentation fault. The yubihsm-shell project is included in the YubiHSM 2 SDK product.

Recommendations: For versions 2.0.0 through 2.0.3, as a temporary workaround, consider disabling the send secure msg() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2021-32489

Affected Products

Yubihsm-Shell

References · 4

• 🔥 https://blog.inhq.net/posts/yubico-libyubihsm-vuln2/#second-attack-variant-cve-pending · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32489 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32489 · Vendor Advisory
• https://t.me/cvenotify/14686 · Telegram Post