[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 13 Dec 2023 15:11:32 +0100
From: Jakub Jelen <jjelen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-40660: Potential PIN bypass with empty PIN in OpenSC before 0.24.0
When the token/card was plugged into the computer and authenticated
from one process, it could be used to provide cryptographic operations
from different process when the empty, zero-length PIN was provided
and the token could track the login status using some of its
internals. This is dangerous for OS logon/screen unlock and small
tokens that are plugged permanently to the computer. The bypass was
removed and OpenSC implemented explicit logout for most of the card
drivers to prevent leaving unattended logged-in tokens.
The PoC is available for MacOS screen unlock bypass with Yubikey. The
issue can be reproduced also with a PKCS#11 module and Minidriver if
the calling applications does not bail out on empty pin (For example
with Firefox. The SSSD does not allow empty PIN under Linux even
before reaching out to the PKCS#11 module).
Note, that the login tracking is still useful on the pkcs15init layer
so the second commit restores the similar code block in more
appropriate place which could not be misused to bypass authentication
on PKCS#11 layer.
Affected versions: OpenSC 0.17.0 - 0.23.0
Fixed with:
868f76fb31255fd3fdacfc3e476452efeb61c3e7
80cc5d30635f0d2c92b5099c0f9dc680d0ffce2f
Originally reported by Deepanjan Pal (Oracle Corporation)
CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (7.3)
The full release notes for the 0.24.0 is available in announce list:
https://sourceforge.net/p/opensc/mailman/message/58712583/
and on github:
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
