PT-2024-3057 · Opensc+3 · Opensc+3

Marco Benatto · Published 2024-02-12 · Updated 2025-01-27 · CVE-2024-1454

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description The issue is related to a use-after-free vulnerability found in the AuthentIC driver of OpenSC packages. This vulnerability occurs during the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs. This manipulation can allow for compromised card management operations during enrolment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2024-14487

ALT-PU-2025-1282

AZL-34384

AZL-35078

BDU:2024-03243

CVE-2024-1454

DLA-4004-1

OPENSUSE-SU-2024:13733-1

ROSA-SA-2025-2581

Affected Products

Alt Linux

Astra Linux

Opensc

Red Os

References · 38

• https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 · Patch
• https://cve.org/CVERecord?id=CVE-2024-1454 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:13733-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-1454 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-1454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1454 · Security Note
• https://osv.dev/vulnerability/AZL-34384 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4004-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-1454 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03243 · Security Note
• https://osv.dev/vulnerability/AZL-35078 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU · Vendor Advisory