mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-10-02 08:02:07 +00:00
47939c2bdc
CVE-2024-45618: A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-45618] Upstream patches: [8632ec172b] [f9d68660f0] Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From f9d68660f032ad4d7803431d5fc7577ea8792ac3 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= <vhanulik@redhat.com>
|
|
Date: Wed, 17 Jul 2024 14:56:22 +0200
|
|
Subject: [PATCH] pkcs15-lib: Report transport key error
|
|
|
|
Thanks Matteo Marini for report
|
|
https://github.com/OpenSC/OpenSC/security/advisories/GHSA-p3mx-7472-h3j8
|
|
|
|
fuzz_pkcs15init/17, fuzz_pkcs15init/18
|
|
|
|
CVE: CVE-2024-45618
|
|
Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/f9d68660f032ad4d7803431d5fc7577ea8792ac3]
|
|
|
|
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
|
|
---
|
|
src/pkcs15init/pkcs15-lib.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/pkcs15init/pkcs15-lib.c b/src/pkcs15init/pkcs15-lib.c
|
|
index f297a5f48..f4cbaa694 100644
|
|
--- a/src/pkcs15init/pkcs15-lib.c
|
|
+++ b/src/pkcs15init/pkcs15-lib.c
|
|
@@ -3767,13 +3767,15 @@ sc_pkcs15init_get_transport_key(struct sc_profile *profile, struct sc_pkcs15_car
|
|
if (callbacks.get_key) {
|
|
rv = callbacks.get_key(profile, type, reference, defbuf, defsize, pinbuf, pinsize);
|
|
LOG_TEST_RET(ctx, rv, "Cannot get key");
|
|
- }
|
|
- else if (rv >= 0) {
|
|
+ } else if (rv >= 0) {
|
|
if (*pinsize < defsize)
|
|
LOG_TEST_RET(ctx, SC_ERROR_BUFFER_TOO_SMALL, "Get transport key error");
|
|
|
|
memcpy(pinbuf, data.key_data, data.len);
|
|
*pinsize = data.len;
|
|
+ } else {
|
|
+ /* pinbuf and pinsize were not filled */
|
|
+ LOG_TEST_RET(ctx, SC_ERROR_INTERNAL, "Get transport key error");
|
|
}
|
|
|
|
memset(&auth_info, 0, sizeof(auth_info));
|
|
--
|
|
2.34.1
|