CVE-2024-45619
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
Risk Assessment
The risk involves potential local or remote exploitation allowing an attacker to gain unauthorized access to sensitive data or disrupt the operation of applications relying on OpenSC.
Recommendation
Immediately update OpenSC to the latest version that includes a fix for this vulnerability. Additionally, restrict the use of untrusted USB devices and smart cards.
Original NVD description (English source)
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.