CVE-2024-1454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1454
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

3.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.4 / Impact : 2.7

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-1454 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2263929 Issue Tracking Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 Patch
https://access.redhat.com/security/cve/CVE-2024-1454 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2263929 Issue Tracking Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:50

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ -
References () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory
References () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch

06 Nov 2024, 15:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Oct 2024, 13:57

Type Values Removed Values Added
First Time Fedoraproject
Opensc Project
Redhat
Fedoraproject fedora
Redhat enterprise Linux
Opensc Project opensc
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
References () https://access.redhat.com/security/cve/CVE-2024-1454 - () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory
References () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ - Mailing List, Third Party Advisory

23 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ -

16 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ -

16 Mar 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ -

13 Feb 2024, 14:01

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad de use-after-free se encontró en el controlador AuthentIC en los paquetes OpenSC y ocurre en el proceso de inscripción de tarjetas usando pkcs15-init cuando un usuario o administrador registra o modifica tarjetas. Un atacante debe tener acceso físico al sistema informático y requiere un dispositivo USB o una tarjeta inteligente manipulada para presentar al sistema respuestas especialmente manipuladas a las APDU, que se consideran de alta complejidad y baja gravedad. Esta manipulación puede permitir operaciones de administración de tarjetas comprometidas durante la inscripción.

12 Feb 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-12 23:15

Updated : 2024-11-21 08:50

NVD link : CVE-2024-1454

Mitre link : CVE-2024-1454

CVE.ORG link : CVE-2024-1454

JSON object : View

Products Affected

opensc_project

  • opensc

fedoraproject

  • fedora

redhat

  • enterprise_linux
CWE
CWE-416

Use After Free