Heap-based buffer overflow vulnerability in libopensc OpenPGP driver could lead to arbitrary code execution
CVE-2024-8443

2.9LOW

Key Information:

Vendor
Red Hat
Status
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Vendor
CVE Published:
10 September 2024

Summary

A heap-based buffer overflow vulnerability exists within the libopensc OpenPGP driver. This vulnerability can be exploited by a crafted USB device or a smart card delivering malicious APDU responses during the card enrollment process using the pkcs15-init tool. This exploitation may allow attackers to execute arbitrary code, thereby compromising the integrity and confidentiality of the affected system.

References

https://access.redhat.com/security/cve/CVE-2024-8443
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2310494
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.