CVE-2024-1454
published 2024-02-12CVE-2024-1454: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or…
PriorityP412low3.4CVSS 3.1
AVPACHPRNUIRSCCLILAN
EPSS
0.42%
34.3th percentile
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | opensc | < opensc 0.23.0-0.3+deb12u2 (bookworm) | opensc 0.23.0-0.3+deb12u2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_opensc_0.23.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_opensc_0.25.1-3_on_azure_linux_3.0 | — | — |
| msrc | cbl2_opensc_0.23.0-4_on_cbl_mariner_2.0 | — | — |
| opensc_project | opensc | < 0.25.0 | 0.25.0 |
| opensc_project | opensc | >= 0 < 0.21.0-1+deb11u1 | 0.21.0-1+deb11u1 |
| opensc_project | opensc | >= 0 < 0.23.0-0.3+deb12u2 | 0.23.0-0.3+deb12u2 |
| opensc_project | opensc | >= 0 < 0.25.0~rc1-1 | 0.25.0~rc1-1 |
| opensc_project | opensc | >= 0 < 0.25.0~rc1-1 | 0.25.0~rc1-1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.13.4LOWCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
osv3.4LOW
vendor_debian3.4LOW
vendor_msrc3.4LOW
vendor_redhat3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Opensc: memory use after free in authentic driver when updating token info
vendor_msrc·2024-02-13·CVSS 3.4
CVE-2024-1454 [LOW] CWE-416 Opensc: memory use after free in authentic driver when updating token info
Opensc: memory use after free in authentic driver when updating token info
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ref
Red Hat
opensc: Memory use after free in AuthentIC driver when updating token info
vendor_redhat·2024-02-12·CVSS 3.4
CVE-2024-1454 [LOW] CWE-416 opensc: Memory use after free in AuthentIC driver when updating token info
opensc: Memory use after free in AuthentIC driver when updating token info
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An
Debian
CVE-2024-1454: opensc - The use-after-free vulnerability was found in the AuthentIC driver in OpenSC pac...
vendor_debian·2024·CVSS 3.4
CVE-2024-1454 [LOW] CVE-2024-1454: opensc - The use-after-free vulnerability was found in the AuthentIC driver in OpenSC pac...
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
Scope: local
bookworm: resolved (fixed in 0.23.0-0.3+deb12u2)
bullseye: resolved (fixed in 0.21.0-1+deb11u1)
forky: resolved (fixed in 0.25.0~rc1-1)
sid: resolved (fixed in 0.25.0~rc1-1)
trixie: resolved (fixed in 0.25.0~rc1-1)
GHSA
GHSA-6q4q-mhg5-v6xh: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a
ghsa_unreviewed·2024-02-13
CVE-2024-1454 [LOW] CWE-416 GHSA-6q4q-mhg5-v6xh: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
OSV
CVE-2024-1454: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a
osv·2024-02-12·CVSS 3.4
CVE-2024-1454 [LOW] CVE-2024-1454: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2024-1454https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898https://bugzilla.redhat.com/show_bug.cgi?id=2263929https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9https://access.redhat.com/security/cve/CVE-2024-1454https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898https://bugzilla.redhat.com/show_bug.cgi?id=2263929https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9https://lists.debian.org/debian-lts-announce/2024/12/msg00026.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/https://lists.fedoraproject.org/archives/list/[email protected]/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/https://lists.fedoraproject.org/archives/list/[email protected]/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/
2024-02-12
Published