Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 13 Dec 2023 15:11:32 +0100
From: Jakub Jelen <>
Subject: CVE-2023-40660: Potential PIN bypass with empty PIN in OpenSC before 0.24.0

When the token/card was plugged into the computer and authenticated
from one process, it could be used to provide cryptographic operations
from different process when the empty, zero-length PIN was provided
and the token could track the login status using some of its
internals. This is dangerous for OS logon/screen unlock and small
tokens that are plugged permanently to the computer. The bypass was
removed and OpenSC implemented explicit logout for most of the card
drivers to prevent leaving unattended logged-in tokens.

The PoC is available for MacOS screen unlock bypass with Yubikey. The
issue can be reproduced also with a PKCS#11 module and Minidriver if
the calling applications does not bail out on empty pin (For example
with Firefox. The SSSD does not allow empty PIN under Linux even
before reaching out to the PKCS#11 module).

Note, that the login tracking is still useful on the pkcs15init layer
so the second commit restores the similar code block in more
appropriate place which could not be misused to bypass authentication
on PKCS#11 layer.

Affected versions: OpenSC 0.17.0 - 0.23.0

Fixed with:


Originally reported by Deepanjan Pal (Oracle Corporation)

CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (7.3)

The full release notes for the 0.24.0 is available in announce list:

and on github:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.