Buffer Overflow Vulnerability in Yubico's Libu2f-host Library

CVE-2018-20340

What is CVE-2018-20340?

The Yubico libu2f-host library version 1.1.6 contains a vulnerability due to unchecked buffers in the devs.c file. This flaw could allow an attacker to exploit a buffer overflow by using a specially crafted USB device that impersonates a legitimate security token, potentially leading to the execution of malicious code on systems where the vulnerable library is utilized. However, it is essential to note that genuine YubiKey devices cannot be used to perform this attack, thus limiting the risk to systems where unauthorized USB devices are connected.

References