CVE-2018-14780

Name of the Vulnerable Software and Affected Versions Yubico-Piv version 1.5.0

Description An out-of-bounds read issue was discovered in the Yubico-Piv smartcard driver. The issue arises from a memmove() operation in the ykpiv fetch object() function, located in the lib/ykpiv.c file, where the length of data to be moved is retrieved from APDU data without being checked for potential out-of-bounds access. This could result in copying bytes behind the allocated data buffer into the buffer.

Recommendations For Yubico-Piv version 1.5.0, as a temporary workaround, consider restricting the use of the ykpiv fetch object() function until a patch is available. Additionally, ensure that all data lengths retrieved from APDU data are thoroughly validated to prevent out-of-bounds access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.