Skip to content

Latest commit

 

History

History
26 lines (20 loc) · 2.25 KB

CVE-2024-45617.md

File metadata and controls

26 lines (20 loc) · 2.25 KB

CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc

The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. The uninitialized variables were reflected in the following functions:

Affected versions: all before 0.26.0

Originally reported by Matteo Marini (Sapienza University of Rome)

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (3.9)