PT-2023-8908 · Opensc+9 · Opensc+9

Tej Rathi · Published 2023-09-25 · Updated 2025-04-09 · CVE-2023-40661

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description The issue is related to several memory vulnerabilities within the OpenSC packages, specifically in the card enrollment process using pkcs15-init. An attacker must have physical access to the computer system and employ a custom-crafted USB device or smart card to manipulate responses to APDUs. This manipulation can potentially allow compromise of key generation, certificate loading, and other card management operations during enrollment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALSA-2023:7876

ALSA-2023:7879

ALSA-2023_7876

ALSA-2023_7879

ALT-PU-2023-8056

ALT-PU-2023-8077

ALT-PU-2023-8185

ALT-PU-2024-7018

AZL-31944

AZL-35075

BDU:2024-02588

CESA-2023_7876

CVE-2023-40661

DLA-3668-1

DLA-4004-1

OPENSUSE-SU-2024:13314-1

RHSA-2023:7876

RHSA-2023:7879

RHSA-2023_7876

RHSA-2023_7879

ROSA-SA-2025-2580

SUSE-SU-2023:4065-1

SUSE-SU-2023:4089-1

SUSE-SU-2023:4104-1

USN-7346-1

USN-7346-2

USN-7346-3

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Opensc

Red Hat

Red Os

Suse

Ubuntu

References · 86

• 🔥 https://github.com/OpenSC/OpenSC/wiki/CVE-2023-40661 · Exploit
• https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-7876.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45618 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7346-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-5992 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45617 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-7876.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7879 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7346-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40661 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45616 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7346-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-45620 · Vendor Advisory