CVE-2024-8443 — Heap-based Buffer Overflow in Redhat Enterprise Linux

CWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds Write10 documents9 sources
Severity
2.9LOWNVD
EPSS
0.2%
top 58.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Opensc Project OpenscRedhat Enterprise Linux
Timeline
PublishedSep 10
Latest updateApr 9

Description

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the `pkcs15-init` tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution.

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 0.4 | Impact: 2.5

Affected Packages1 packages

▶Debianopensc_project/opensc< 0.21.0-1+deb11u1+3

Also affects: Enterprise Linux 7.0, 8.0, 9.0

🔴Vulnerability Details

3
OSV
CVE-2024-8443: A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver↗2024-09-10
▶
CVEList
Libopensc: heap buffer overflow in openpgp driver when generating key↗2024-09-10
▶
GHSA
GHSA-mgc5-p43f-72pc: A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver↗2024-09-10
▶

📋Vendor Advisories

5
Ubuntu
OpenSC vulnerabilities↗2025-04-09
▶
Ubuntu
OpenSC vulnerabilities↗2025-03-12
▶
Microsoft
Libopensc: heap buffer overflow in openpgp driver when generating key↗2024-09-10
▶
Red Hat
libopensc: Heap buffer overflow in OpenPGP driver when generating key↗2024-09-04
▶
Debian
CVE-2024-8443: opensc - A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP dr...↗2024
▶
CVE-2024-8443 — Heap-based Buffer Overflow in Redhat | cvebase