The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0441 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5992:
    A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-     channel resistant. This issue may result in the potential leak of private data.

    CVE-2024-1454:
    The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the     card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An     attacker must have physical access to the computer system and requires a crafted USB device or smart card     to present the system with specially crafted responses to the APDUs, which are considered high complexity     and low severity. This manipulation can allow for compromised card management operations during enrolment.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-
    channel resistant. This issue may result in the potential leak of private data. (CVE-2023-5992)

  - The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the
    card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An
    attacker must have physical access to the computer system and requires a crafted USB device or smart card
    to present the system with specially crafted responses to the APDUs, which are considered high complexity
    and low severity. This manipulation can allow for compromised card management operations during enrolment.
    (CVE-2024-1454)

The version of opensc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1454 advisory.

  - The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the     card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An     attacker must have physical access to the computer system and requires a crafted USB device or smart card     to present the system with specially crafted responses to the APDUs, which are considered high complexity     and low severity. This manipulation can allow for compromised card management operations during enrolment.
    (CVE-2024-1454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of opensc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1454 advisory.

  - The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the     card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An     attacker must have physical access to the computer system and requires a crafted USB device or smart card     to present the system with specially crafted responses to the APDUs, which are considered high complexity     and low severity. This manipulation can allow for compromised card management operations during enrolment.
    (CVE-2024-1454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4004 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4004-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     December 28, 2024                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : opensc     Version        : 0.21.0-1+deb11u1     CVE ID         : CVE-2021-34193 CVE-2021-42778 CVE-2021-42779 CVE-2021-42780                      CVE-2021-42781 CVE-2021-42782 CVE-2023-2977 CVE-2023-5992                      CVE-2023-40660 CVE-2023-40661 CVE-2024-1454 CVE-2024-8443                      CVE-2024-45615 CVE-2024-45616 CVE-2024-45617 CVE-2024-45618                      CVE-2024-45619 CVE-2024-45620     Debian Bug     : 1037021 1055521 1055522 1064189 1082853 1082859 1082860                      1082861 1082862 1082863 1082864

    Multiple vulnerabilities were found in opensc, a set of libraries and     utilities to access smart cards, which could lead to application crash,     information leak, or PIN bypass.

    CVE-2021-34193

        Multiple stack overflow vulnerabilities were discovered in OpenSC         smart card middleware via crafted responses to APDUs.

    CVE-2021-42778

        A heap double free issue was found in sc_pkcs15_free_tokeninfo().

    CVE-2021-42779

        A heap use after free issue was found in sc_file_valid().

    CVE-2021-42780

        A use after return issue was found in the insert_pin() function,         which could potentially crash programs using the library.

    CVE-2021-42781

        Multiple heap buffer overflow issues were found in         pkcs15-oberthur.c, which could potentially crash programs using the         library.

    CVE-2021-42782

        Multiple buffer overflow issues were found in various places, which         could potentially crash programs using the library.

    CVE-2023-2977

        A buffer overrun vulnerability was found in pkcs15's         cardos_have_verifyrc_package().  When supplying a smart card package         with malformed ASN.1 context, an attacker can trigger a crash or         information leak via heap-based buffer out-of-bound read.

    CVE-2023-5992

         Alicja Karion discovered that the code handling the PKCS#1.5          encryption padding removal was not implemented in side-channel          resistant way, which can lead to decryption of previously captured          RSA ciphertexts and forging of signatures based on the timing data          (Marvin attack).

    CVE-2023-40660

        Deepanjan Pal discovered a potential PIN bypass with empty PIN.
        When the token/card was plugged into the computer and authenticated         from one process, it could be used to provide cryptographic         operations from different process when the empty, zero-length PIN         was provided.

    CVE-2023-40661

        Multiple memory vulnerabilities were found by dynamic analyzers in         pkcs15-init.

    CVE-2024-1454

        A memory use after free issue was found in AuthentIC driver when         updating token info.

    CVE-2024-8443

        An heap buffer overflow issue was found in OpenPGP driver during key         generation.

    CVE-2024-45615

        Matteo Marini discovered multiple uses of uninitialized values in         libopensc and pkcs15init.

    CVE-2024-45616

        Matteo Marini discovered multiple uses of uninitialized values after         incorrect check or usage of APDU response values in libopensc.

    CVE-2024-45617

        Matteo Marini discovered multiple uses of uninitialized values after         incorrect or missing checking return values of functions in         libopensc.

    CVE-2024-45618

        Matteo Marini discovered multiple uses of uninitialized values after         incorrect or missing checking return values of functions in         pkcs15init.

    CVE-2024-45619

        Matteo Marini discovered multiple incorrect handling of length of         buffers or files in libopensc, which could result in application         crash or information leak.  When buffers are partially filled with         data, uninitialized parts of the buffer may be incorrectly accessed.

    CVE-2024-45620

        Matteo Marini discovered multiple incorrect handling of length of         buffers or files in pkcs15init, which could result in application         crash or information leak.  When buffers are partially filled with         data, uninitialized parts of the buffer may be incorrectly accessed.

    For Debian 11 bullseye, these problems have been fixed in version     0.21.0-1+deb11u1.

    We recommend that you upgrade your opensc packages.

    For the detailed security status of opensc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/opensc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3dbc3e8105 advisory.

    New upstream release with security fixes for CVE-2023-5992 and CVE-2024-1454

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-580 advisory.

    A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-     channel resistant. This issue may result in the potential leak of private data. (CVE-2023-5992)

    The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the     card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An     attacker must have physical access to the computer system and requires a crafted USB device or smart card     to present the system with specially crafted responses to the APDUs, which are considered high complexity     and low severity. This manipulation can allow for compromised card management operations during enrolment.
    (CVE-2024-1454)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-6460a03e29 advisory.

    New upstream release with security fixes for CVE-2023-5992 and CVE-2024-1454

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b92d44f141 advisory.

    New upstream release with security fixes for CVE-2023-5992 and CVE-2024-1454

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238835	TencentOS Server 4: opensc (TSSA-2024:0441)	Nessus	Tencent Local Security Checks	medium
426639	Alpine: multiple opensc packages: security update to 0.25.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
426639	Alpine: multiple opensc packages: security update to 0.25.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
217102	Azure Linux 3.0 Security Update: opensc (CVE-2024-1454)	Nessus	Azure Linux Local Security Checks	low
217091	CBL Mariner 2.0 Security Update: opensc (CVE-2024-1454)	Nessus	MarinerOS Local Security Checks	low
213413	Debian dla-4004 : opensc - security update	Nessus	Debian Local Security Checks	high
194700	Fedora 40 : opensc (2024-3dbc3e8105)	Nessus	Fedora Local Security Checks	medium
192891	Amazon Linux 2023 : opensc (ALAS2023-2024-580)	Nessus	Amazon Linux Local Security Checks	medium
192170	Fedora 39 : opensc (2024-6460a03e29)	Nessus	Fedora Local Security Checks	medium
192166	Fedora 38 : opensc (2024-b92d44f141)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2024-1454

low

Tenable Plugins

medium

medium

medium

low

low

high

medium

medium

medium

medium