CVE-2024-45616

Sept. 13, 2024, 7:21 p.m.

CVSS Score

3.9 / 10

Products Impacted

Vendor Product Versions
redhat
  • enterprise_linux
  • 7.0, 8.0, 9.0
opensc_project
  • opensc
  • *

Description

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.

Weaknesses

CWE-457
Use of Uninitialized Variable

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

CWE ID: 457
CWE-908
Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

CWE ID: 908

Date

Published: Sept. 3, 2024, 10:15 p.m.

Last Modified: Sept. 13, 2024, 7:21 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o redhat enterprise_linux 7.0 / / / / / / /
o redhat enterprise_linux 8.0 / / / / / / /
o redhat enterprise_linux 9.0 / / / / / / /
a opensc_project opensc / / / / / / / /

CVSS Data

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

Base Score
3.9
Exploitability Score
0.5
Impact Score
3.4
Base Severity
LOW
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References