OpenSC pkcs11-tool Global Buffer Overflow Vulnerability

Vulnerability Overview Vulnerability Name: OpenSC pkcs11-tool Global Buffer Overflow Vulnerability Vulnerability Type: Buffer Overflow (CWE-120 / CWE-787) Affected Component: OpenSC (specifically ) Affected Versions: OpenSC 0.26.1 and earlier Severity: Medium/High (depending on execution context) Attack Vector: Local/Physical Prerequisites: The attacker must create a malicious PKCS#11 module for the victim to load, or provide a malicious physical smart card device with custom firmware, and induce the victim to interact with it via , thereby triggering the logic. Scope of Impact Vulnerability Description: In OpenSC version 0.26.1, the file contains a global buffer overflow vulnerability occurring during key pair generation tests, such as when using , , and . This vulnerability is caused by a lack of input validation. Root Cause: In the function , after dynamically retrieving the attribute returned by the underlying PKCS#11 token or smart card, the function fails to verify the length of the returned data. Instead, it directly copies the data into a fixed-size global static buffer, which is only 100 bytes long. Remediation Add Explicit Boundary Checks Modify as follows: Other Recommendations Audit all uses of to ensure that the returned length is correctly validated before any memory copy operations. Ensure that all buffer operations include strict boundary validation. Avoid implicit trust of responses from hardware or external modules. POC Code Verification Steps 1. Download the provided archive file. 2. Execute the provided script. 3. The script compiles into and loads it into an ASAN-instrumented . 4. If a segmentation fault occurs or the aforementioned AddressSanitizer error is reported, the vulnerability has been successfully reproduced. Expected Behavior should validate the length of the returned attribute before copying it into the fixed-size global buffer. If the length of the returned exceeds the capacity of the target buffer, the tool should reject the value, report an error, free the allocated memory, and terminate the current operation safely, without performing any out-of-bounds writes. Actual Behavior In , after retrieving the of the generated private key, only checks whether the returned length is zero, but does not enforce an upper bound check. The returned length is directly assigned to and then used in . When a malicious PKCS#11 module or smart card returns an excessively large , the copy operation exceeds the 100-byte global buffer , triggering a global buffer overflow. In our reproduction, a 200-byte resulted in AddressSanitizer reporting a . OpenSC Version OpenSC 0.26.1 and earlier Operating System Ubuntu 22.04 Smart Card Model or Security Token N/A Application Used with Smart Card N/A Logs and Debug Output N/A Checklist [x] I am using a supported OpenSC version [x] I have searched existing issues to avoid duplicates

Goal Reached Thanks to every supporter — we hit 100%!

OpenSC pkcs11-tool Global Buffer Overflow Vulnerability

More from this source