#VU66136 Unchecked Return Value in OpenSC - CVE-2021-42780

Vulnerability identifier: #VU66136

Vulnerability risk: Low

CVSSv4.0: 0.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-42780

CWE-ID: CWE-252

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
OpenSC
Universal components / Libraries / Libraries used by multiple products

Vendor: OpenSC

Description

The vulnerability allows an attacker with physical access to perform denial of service attacks.

The vulnerability exists due to use after return issue in insert_pin() function in  Opensc. An attacker with physical access can trigger the vulnerability to perform denial of service attacks.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenSC: 0.2.0 - 0.21.0

---

External links
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
https://github.com/OpenSC/OpenSC/commit/5df913b7
https://bugzilla.redhat.com/show_bug.cgi?id=2016139

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.