Skip to content

Commit a9792ce

Browse files
JakujeJakuje
committed
OpenSC 0.27.0 release
1 parent dfd2bd1 commit a9792ce

7 files changed

Lines changed: 211 additions & 0 deletions

‎CVE-2025-13763.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# [CVE-2025-13763](https://nvd.nist.gov/vuln/detail/CVE-2025-13763): Various uninitialized memory usage during card detection in libopensc
2+
3+
The reported issues are part of the libopensc library, which makes them
4+
accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
5+
The attack requires a crafted USB device or smart card that would present
6+
the system with specially crafted responses to the APDUs, so they are
7+
considered high complexity and low severity.
8+
9+
The uninitialized variables were reflected in these functions:
10+
11+
- [authentic_parse_credential_data](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-authentic.c#L300)
12+
- The function `authentic_get_tagged_data()` could return 0 length data,
13+
but it is never checked before dereferencing the data pointer.
14+
- fixed with dc4a1f2617867eb3b2c170ec51dd2bbae0212480
15+
- [cac_is_cert](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-cac.c#L237)
16+
- The object comparison could use some of the unitialized object members.
17+
- fixed with 61985ce021b386b11a29eb4d27c6a7ae00e8e2a6
18+
- [cac_read_binary](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-cac.c#L526)
19+
- the function is merging the TagLength file with the Value files.
20+
Inconsistencies are ignored, but the resulting object has full
21+
length even if some part is uninitialized, which can be used later
22+
on by the driver.
23+
- fixed with 35b2f54212db0d6adcc337e456ddc728eeabd044
24+
- [cac_get_properties](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-cac.c#L932)
25+
- the function might not be setting all the members of the properties
26+
structure the caller expects. Initializing it before invocation
27+
avoids this problem.
28+
- fixed with 5b0cda30e8226c41c69735f95234d98eda1be550
29+
- [esteid_select_file](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-esteid2018.c#L122)
30+
- the select file assumes the APDU returns the whole requested length,
31+
which might not be the case. When card returns less data,
32+
the uninitialized data is attempted to get parsed as FCI structure.
33+
- fixed with bd8687b40f6948278ec115aa7a19ee7274760ce0
34+
- [gemsafe_process_fci](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-gemsafeV1.c#L350)
35+
- The `sc_asn1_find_tag()` could return 0-lenght value, which is processed
36+
without checking for the length.
37+
- fixed with 267111f2e3b766e5ad985105cd1a3416d569ff89
38+
- [iasecc_emulate_fcp](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/card-iasecc.c#L862)
39+
- emulating the FCP object could result in too long resplen in the emulated
40+
APDU returned to a caller, which might read uninitialized data from there.
41+
- fixed with ab568f0a420931d5372bc8657f4024ca6d0e3285
42+
- [iasecc_se_parse](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/iasecc-sdo.c#L328)
43+
- the function could use uninitialized memory behind the buffer bounds
44+
without proper check.
45+
- fixed with 7aafe6f8c4a962d8ee9208a62272b6b38d6db9f6, a89dff3271da2eccd834553a4c0dfb7c543657c5
46+
- [get_cert_len](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-atrust-acos.c#L81)
47+
- incorrect return value check could cause use of uninitialized data
48+
- fixed with 7e3dcae1d14e898dfed00ce8aa1d1bfeaee7c936
49+
- [coolkey_get_attribute_bytes_alloc](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-coolkey.c#L212)
50+
- Unchecked size of return buffer could cause zero-length allocations
51+
and following code dereferencing this variable.
52+
- fixed with 40fbddc46e026618b6a3d0a03e62adc1fb5ca956
53+
- [sc_pkcs15emu_openpgp_init](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-openpgp.c#L318)
54+
- uninitilized variable could cause comparison against this value,
55+
with unexpected consequences.
56+
- fixed with 29122ae779fa8ecb201b0c0b3bdad058b9540262
57+
- [sc_pkcs15_pubkey_from_spki_fields](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-pubkey.c#L1342)
58+
- the callback function could be called with 0-length buffer,
59+
resulting in 0-lenght allocations and dereferencing of this value.
60+
- fixed with 7000dee0eb7d35246b5e180b39bb4e03b11f1c47
61+
- [get_cert_len](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-starcert.c#L91)
62+
- the function accesses the uninitialized memory when the card returns
63+
too short response.
64+
- fixed with 7e3dcae1d14e898dfed00ce8aa1d1bfeaee7c936
65+
- [insert_cert](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/libopensc/pkcs15-tcos.c#L81)
66+
- Parsing of the returned buffer could use uninitialized memory when
67+
the card responses with too short data.
68+
- fixed with 263d29e2f8baf33f329849c82ba9c08ec45f1ad7
69+
70+
There are few more cases, that are accessible only during the card
71+
enrollment/initialization and therefore they are not exploitable on generic
72+
end-user system:
73+
74+
- [entersafe_init_card](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/pkcs15init/pkcs15-entersafe.c#L80)
75+
- Uninitialized members could be used in the APDU,
76+
resulting in unexpected behavior.
77+
- fixed with f29e937aa77ad000cd65cc1806972203bd3b0f43
78+
- [cosm_generate_key](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/pkcs15init/pkcs15-oberthur.c#L692)
79+
- Uninitialized member `pubkey->u.rsa.modulus.len` is used later
80+
in the code execution.
81+
- fixed with a998551ca19f2bd0e664c59d415675c062e3920b
82+
- [build_argv](https://github.com/OpenSC/OpenSC/blob/23dcca082fa35eb454f8a2add163dfd506eab434/src/pkcs15init/profile.c#L2090)
83+
- Ignoring return value of `get_inner_word()a could cause use
84+
of uninitilizad variables later.
85+
- fixed with c1d3ebb130f909eff2aef1924f28f3d4c04786a6
86+
87+
Affected versions: all before 0.27.0
88+
89+
Originally reported by Matteo Marini (Sapienza University of Rome).
90+
Some of the issues were also reported independently by Aldo Ristori via OSS-Fuzz.
91+
Patches provided by Jakub Jelen.
92+
93+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2025-49010.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# [CVE-2025-49010](https://nvd.nist.gov/vuln/detail/CVE-2025-49010): Possible write beyond buffer bounds during processing of GET RESPONSE APDU
2+
3+
The malicious smart card could return 0-length data in GET RESPONSE APDU,
4+
causing the driver writing behind the caller provided buffer in
5+
`sc_get_response()` function.
6+
7+
Affected are the following card drivers:
8+
skeid, cardos, cyberflex, gemsafeV1, starcos, tcos, oberthur, authentic, iasecc, belpic, entersafe,
9+
rutoken_ecp, myeid, dnie, MaskTech, esteid2018, idprime, edo, coolkey, muscle, sc-hsm, mcrd, setcos,
10+
PIV-II, cac, itacns, isoApplet, gids, openpgp, jpki, npa, cac1, nqapplet, eOI, default
11+
12+
The reported issue is part of the libopensc library, which makes them
13+
accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
14+
The attack requires a crafted USB device or smart card that would present
15+
the system with specially crafted responses to the APDUs, so this is
16+
considered high complexity and low severity.
17+
18+
- [sc_get_response](https://github.com/OpenSC/OpenSC/blob/e88272d556f51dde2e789cf8d9afafd8b490cf67/src/libopensc/apdu.c#L481)
19+
- The `iso7816_get_response()` and `nqapplet_get_response()` returned
20+
early if the returned APDU did not have any data without adjusting
21+
the `count` return parameter to reflect this legnth.
22+
- fixed with 953986f65db61871bbbff72788d861d67d5140c6
23+
24+
Affected versions: all before 0.27.0
25+
26+
Originally reported by Oss-fuzz.
27+
Patches provided by Frank Morgner.
28+
29+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) (3.8)
30+

‎CVE-2025-66037.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# [CVE-2025-66037](https://nvd.nist.gov/vuln/detail/CVE-2025-66037): Possible buffer overrun while parsing SPKI
2+
3+
The malicious smart card could return malicious public key object with
4+
SPKI size of 0, resulting of reading behind the 0-length buffer, potentially
5+
causing either crash or unexpected behavior of application using OpenSC.
6+
7+
The reported issue is part of the libopensc library, which makes them
8+
accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
9+
The attack requires a crafted USB device or smart card that would present
10+
the system with specially crafted responses to the APDUs, so this is
11+
considered high complexity and low severity.
12+
13+
- [sc_pkcs15_pubkey_from_spki_fields](https://github.com/OpenSC/OpenSC/blob/220bc82e08e71d720d742ce2e8713dc9af14dade/src/libopensc/pkcs15-pubkey.c#L1342)
14+
- The function is provided with a buffer parsed from the outer ASN.1
15+
structure, which can be a 0-length buffer. The buffer is copied
16+
with malloc & memcpy and then the first byte is tested without
17+
checking the length is at least one byte.
18+
- fixed with 65fc211015cfcac27b10d0876054156c97225f50
19+
20+
Affected versions: all before 0.27.0
21+
22+
Originally reported by Aldo Ristori via OSS-Fuzz.
23+
Patches provided by Jakub Jelen.
24+
25+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)

‎CVE-2025-66038.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# [CVE-2025-66038](https://nvd.nist.gov/vuln/detail/CVE-2025-66038): Possible read beyond buffer bounds when parsing historical bytes in PIV driver
2+
3+
The malicious smart card could return malicious Answer to Reset (ATR) with
4+
invalid Compact-TLV encoding in the historical bytes, resulting in
5+
reading behind the buffer bounds, potentially causing either crash
6+
or unexpected behavior of application using OpenSC.
7+
8+
The reported issue is part of the libopensc library, which makes them
9+
accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
10+
The attack requires a crafted USB device or smart card that would present
11+
the system with specially crafted responses to the APDUs, so this is
12+
considered high complexity and low severity.
13+
14+
- [sc_compacttlv_find_tag](https://github.com/OpenSC/OpenSC/blob/1243e53ebdc48521bb6d462acf1a1ed728cadbe2/src/libopensc/sc.c#L1068)
15+
- The function is provided with buffer and its bounds, but the bounds
16+
of parsed data are checked only if the searched tag has its expected
17+
length (low nibble). In other cases, the bounds are ignored and function
18+
can return the tag length larger than the provided buffer.
19+
- fixed with a20b91adc2fc66785c0df98abc8ef456c0eaab9d
20+
21+
Affected versions: all before 0.27.0
22+
23+
Originally reported by Harrison Green, from CMU. This testcase was discovered by STITCH, an autonomous fuzzing system.
24+
Patches provided by Jakub Jelen.
25+
26+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) (3.9)
27+

‎CVE-2025-66215.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# [CVE-2025-66215](https://nvd.nist.gov/vuln/detail/CVE-2025-66215): Possible write beyond buffer bounds in oberthur driver
2+
3+
The malicious smart card could return larger data then expected
4+
by the oberthur driver, resulting in write behind the buffer bounds
5+
potentially causing crash, data corruption or unexpected behavior
6+
of application using OpenSC.
7+
8+
The reported issue is part of the libopensc library, which makes them
9+
accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK.
10+
The attack requires a crafted USB device or smart card that would present
11+
the system with specially crafted responses to the APDUs, so this is
12+
considered high complexity and low severity.
13+
14+
- [auth_compute_signature](https://github.com/OpenSC/OpenSC/blob/2742f82e74dbed7e781170cad0fdc4187dc88b80/src/libopensc/card-oberthur.c#L1130)
15+
- The function is constructing an APDU request, but sets inconsisten
16+
respons buffer and response buffer length values. When the malicious
17+
smart card would return more data than expected, the reader driver
18+
would write behind the buffer bounds on stack, likely malforming
19+
other data on stack.
20+
- fixed with a4bbf8a631537a4c0083b264095ed1cd36d307ab and 56bc5e9575965461d99a274be45d71c18ab6eae0
21+
22+
Affected versions: all before 0.27.0
23+
24+
Originally reported by Oss-fuzz.
25+
Patches provided by Frank Morgner.
26+
27+
CVSS:3.1[/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) (3.8)

‎Home.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ Do NOT attempt to add them here or use any links from wiki to download software
99

1010
## News
1111

12+
* 30.03.2026: **SECURITY**: Data handling issues prior to 0.27.0 (CVE-2025-49010, CVE-2025-66037, CVE-2025-66038, CVE-2025-13763, CVE-2025-66215), see [security advisories](OpenSC-security-advisories).
13+
* 30.03.2026: [OpenSC 0.27.0](https://github.com/OpenSC/OpenSC/releases/tag/0.27.0) is available.
1214
* 14.01.2025: [OpenSC 0.26.1](https://github.com/OpenSC/OpenSC/releases/tag/0.26.1) is available.
1315
* 13.11.2024: [OpenSC 0.26.0](https://github.com/OpenSC/OpenSC/releases/tag/0.26.0) is available.
1416
* 05.04.2024: [OpenSC 0.25.1](https://github.com/OpenSC/OpenSC/releases/tag/0.25.1) is available.

‎OpenSC-security-advisories.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
Software often contains bugs, so does OpenSC. Be aware of the following security issues (in addition to overall [security considerations](Security-Considerations)) and upgrade to latest released version if needed.
44

5+
* 30.03.2026 Several data handling issues affecting releases before 0.27.0
6+
* [CVE-2025-49010](CVE-2025-49010): Possible write beyond buffer bounds during processing of GET RESPONSE APDU
7+
* [CVE-2025-66037](CVE-2025-66037): Possible buffer overrun while parsing SPKI
8+
* [CVE-2025-66038](CVE-2025-66038): Possible read beyond buffer bounds when parsing historical bytes in PIV driver
9+
* [CVE-2025-13763](CVE-2025-13763): Various uninitialized memory usage during card detection in libopensc
10+
* [CVE-2025-66215](CVE-2025-66215): Possible write beyond buffer bounds in oberthur driver
11+
* More low-severity data handling issues when parsing profile configuration
512
* 05.09.2024 Heap buffer overflow issue has been identified in OpenSC driver for OpenPGP [CVE-2024-8443](CVE-2024-8443)
613
* 04.09.2024 Uninitialized memory issues have been identified in OpenSC
714
* [CVE-2024-45615](CVE-2024-45615): Usage of uninitialized values in libopensc and pkcs15init

0 commit comments

Comments
 (0)