CVE-2023-2977

Name of the Vulnerable Software and Affected Versions OpenSC (affected versions not specified)

Description A security flaw in OpenSC causes a buffer overrun vulnerability in pkcs15 cardos have verifyrc package. An attacker can supply a smart card package with malformed ASN1 context. The cardos have verifyrc package function scans the ASN1 buffer for 2 tags, where the remaining length is wrongly calculated due to a moved starting pointer. This leads to a possible heap-based buffer out of bounds read. In cases where ASAN is enabled while compiling, this causes a crash. Further information leak or more damage is possible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.