CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init
The reported issues are part of the card enrollment process using the pkcs15-init tool. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.
Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. The uninitialized variables were reflected in the following functions:
- strlen, called from set_string
- no checking of return value in sc_pkcs15emu_tcos_init_ex (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/pkcs15-tcos.c#L536)
- fixed with 8632ec172beda894581d67eaa991e519a7874f7d
- sc_build_pin
- missing error handling in sc_pkcs15init_verify_secret (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L3831-L3841)
- found via fuzz_pkcs15init
- fixed with f9d68660f032ad4d7803431d5fc7577ea8792ac3
- DES_set_key_unchecked, called from openssl_enc
- missing error handling in sc_pkcs15init_verify_secret (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/pkcs15init/pkcs15-lib.c#L3831-L3841)
- found via fuzz_pkcs15init
- fixed with f9d68660f032ad4d7803431d5fc7577ea8792ac3
Affected versions: all before 0.26.0
Originally reported by Matteo Marini (Sapienza University of Rome)
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (3.9)