Bug 1628040 (CVE-2018-16424)

Summary: CVE-2018-16424 opensc: Double free handling responses from smartcards in tools/egk-tool.c:read_file()
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: gmazyland, jjelen, klember, nmavrogi, tmraz
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: opensc 0.19.0-rc1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-09-18 08:04:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1628041, 1628042    
Bug Blocks: 1622787    

Description Sam Fowler 2018-09-12 06:18:15 UTC
A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

External References:


Upstream Patch:


Comment 1 Sam Fowler 2018-09-12 06:18:46 UTC
Created opensc tracking bugs for this issue:

Affects: fedora-all [bug 1628041]

Comment 3 Doran Moppert 2018-09-18 07:51:23 UTC
The affected file does not exist in opensc-0.16.0, nor do its predecessors (read_file & related functions elsewhere) seem to realloc.