A flaw was found in pcsc-lite. A memory leak in SCardEstablishContextTH() function in winscard_clnt.c may lead to denial of service. References: https://salsa.debian.org/rousseau/PCSC/issues/1
Created pcsc-lite tracking bugs for this issue: Affects: fedora-all [bug 1684674]
Red Hat Enterprise 7 seems to be unaffected by this when testing OpenSC. (after applying the upstream patch to remove the first memory leak in eidenv) ``` valgrind --leak-check=full eidenv ==8831== Memcheck, a memory error detector ==8831== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==8831== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==8831== Command: eidenv ==8831== No smart card readers found. Failed to connect to card: Unknown error ==8831== ==8831== HEAP SUMMARY: ==8831== in use at exit: 1,607 bytes in 6 blocks ==8831== total heap usage: 62 allocs, 56 frees, 5,619 bytes allocated ==8831== ==8831== LEAK SUMMARY: ==8831== definitely lost: 0 bytes in 0 blocks ==8831== indirectly lost: 0 bytes in 0 blocks ==8831== possibly lost: 0 bytes in 0 blocks ==8831== still reachable: 1,607 bytes in 6 blocks ==8831== suppressed: 0 bytes in 0 blocks ==8831== Reachable blocks (those to which a pointer was found) are not shown. ==8831== To see them, rerun with: --leak-check=full --show-leak-kinds=all ==8831== ==8831== For counts of detected and suppressed errors, rerun with: -v ==8831== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0) ```
Unable to reproduce this on anything. It was reproducible yesterday on my Fedora 29 install, but no longer today. Tried it on a bunch of other VMs, OS versions, different build options, etc. Unclear what I was seeing, but I think it was a fluke. Closing due to low severity of this.
The bug described in https://salsa.debian.org/rousseau/PCSC/issues/1 is still not fixed upstream. I don't think this issue could lead to a denial of service. The allocation is done only once per execution of a PC/SC client application. I agree it is a minor issue. As the upstream developer I have no plan to fix it soon.