Ubuntu alert USN-7346-2 (opensc)
| From: | Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-7346-2] OpenSC regression | |
| Date: | Fri, 28 Mar 2025 15:53:40 -0230 | |
| Message-ID: | <909bc4f3-5c91-438d-8dd5-e5404ce7c2d5@canonical.com> |
========================================================================== Ubuntu Security Notice USN-7346-2 March 28, 2025 opensc regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: USN-7346-1 introduced a regression in OpenSC. Software Description: - opensc: Smart card utilities with support for PKCS#15 compatible cards Details: USN-7346-1 fixed vulnerabilities in OpenSC. The update introduced a regression in Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. The security fix has been removed pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a use-after-free vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42780) It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a stack buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-42782) It was discovered that OpenSC did not correctly handle the length of certain buffers, which could lead to a out-of-bounds access vulnerability. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-2977) Deepanjan Pal discovered that OpenSC did not correctly authenticate a zero length PIN. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40660) It was discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to compromise key generation, certificate loading and other card management operations. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-40661) Hubert Kario, Michal Shagam and Eyal Ronen discovered that OpenSC had a timing side-channel and incorrectly handled RSA padding. An attacker could possibly use this issue to recover sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-5992) Matteo Marini discovered that OpenSC did not properly manage memory due to certain uninitialized variables. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45615) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45616, CVE-2024-45617) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. (CVE-2024-45618, CVE-2024-45620) Matteo Marini discovered that OpenSC did not correctly handle certain memory operations. A physically proximate attacker could possibly use this issue to gain unauthorized access to certain systems. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-45619) It was discovered that OpenSC did not correctly handle certain memory operations, which could lead to a buffer overflow. A physically proximate attacker could possibly use this issue to compromise card management operations during enrollment and modification. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-8443) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS opensc 0.20.0-3ubuntu0.1~esm3 Available with Ubuntu Pro opensc-pkcs11 0.20.0-3ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 18.04 LTS opensc 0.17.0-3ubuntu0.1~esm3 Available with Ubuntu Pro opensc-pkcs11 0.17.0-3ubuntu0.1~esm3 Available with Ubuntu Pro Ubuntu 16.04 LTS opensc 0.15.0-1ubuntu1+esm3 Available with Ubuntu Pro opensc-pkcs11 0.15.0-1ubuntu1+esm3 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7346-2 https://ubuntu.com/security/notices/USN-7346-1 https://launchpad.net/bugs/2104948
Attachment: OpenPGP_signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAmfm6SwFAwAAAAAACgkQyfW2m9Ldu6te zQ/+Ohucko0+BK+uoNDUnydoEjkdEJ1n/jtbBzSyR22xFRNHZzyJe1O/M9y7JTgKzH+U5226ntfi QcJfSOyS0GgLKAZsZf44ELRO+FPQcacwSXg25OBZLNiimHt+tmKhUCbGMgQNh8MFszpu9dxlUsk9 vv9L4FluA1/ln5ytR0pgX1uQxh9u+E2Gwo4p2NsMAJxWcGN2jfHgWrj3pkMfqpFiy8eqIJubeCTQ DGfcHhfweBlh9IxPou0JY8AVU+lTLBl3hAZe0COVXGItAWKQc34OKwW6wX8R6IvluHZusuMRuPR5 m+vrqywd5D+Y/jsf0OXP6Hsg4R4UwTzbR7RglCELXfPPu5nHb7M3XPNpMmTxSSUAgG4Up3ZRPGbB ew+YHIUZO8KsRRYYp6BE7kOe3+u6vOg0/E3i3GvpBhrzpBAKM2YnXngnqfj5OEDecwvRqfXnDSc+ NMfeOUrv549GhjezC7hEoFUTU5tJ+N9fXTuUTTcbMwPN+LVIeKPhcx0lh4gyWPiXREAtGESDHfza we+ID4FXaZP+/ian8HQkwF0SRmdDb3kOOtEix0yNXIN+zrmjNKUbNHQA5v/XV/enMonBeAj4UbZu nRQM69Ss/IjkgmiogJ6ubRYIDllVnFccBHqCUlPjnliZLw1wzCuyrWKTXxwqhXZtNVvnDC/yMdCB P6Y= =vowz -----END PGP SIGNATURE-----
Attachment: None (type=text/plain)