Vulnerability CVE-2019-20792

Vulnerability Name:

CVE-2019-20792 (CCN-182325)

Assigned:

2019-12-02

Published:

2019-12-02

Updated:

2020-05-26

Summary:

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.

CVSS v3 Severity:

6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Physical Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

3.3 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

6.4 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
5.6 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Physical Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

1.7 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-415
CWE-416

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2019-20792

Source: CCN
Type: Google Security Research Issue 19208
opensc:fuzz_pkcs15_reader: Heap-double-free in coolkey_free_private_data

Source: MISC
Type: Exploit, Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208

Source: XF
Type: UNKNOWN
opensc-cve201920792-dos(182325)

Source: CCN
Type: OpenSC GIT Repository
OpenSC

Source: MISC
Type: Patch, Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/c246f6f69a749d4f68626b40795a4f69168008f4

Source: MISC
Type: Release Notes, Third Party Advisory
https://github.com/OpenSC/OpenSC/compare/0.19.0...0.20.0

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2019-20792

Vulnerable Configuration:

Configuration 1:

cpe:/a:opensc-project:opensc:*:*:*:*:*:*:*:* (Version < 0.20.0)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

Configuration CCN 1:

cpe:/a:opensc_project:opensc:0.19.0:-:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:7724	P	opensc-0.22.0-150400.1.7 on GA media (Moderate)	2023-06-12
oval:org.opensuse.security:def:3130	P	libSDL-1_2-0-1.2.15-15.11.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:3380	P	tar-1.27.1-15.3.7 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:94760	P	opensc-0.22.0-150400.1.7 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:94492	P	apache2-2.4.51-150400.4.6 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:95195	P	icedtea-web-1.7.2-150100.7.3.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:249	P	opensc-0.19.0-3.7.1 on GA media (Moderate)	2022-06-13
oval:org.opensuse.security:def:1178	P	Security update for go1.18 (Important)	2022-06-07
oval:org.opensuse.security:def:113063	P	opensc-0.22.0-3.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:101025	P	opensc-0.19.0-3.7.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:62267	P	opensc-0.19.0-3.7.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:72008	P	opensc-0.19.0-3.7.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101205	P	libmodplug-devel-0.3.19-2.10.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101908	P	Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP3) (Important)	2021-07-29
oval:org.opensuse.security:def:111326	P	Security update for opensc (Moderate)	2021-04-16
oval:org.opensuse.security:def:66736	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:75804	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:107871	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:5647	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:96842	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:108574	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:117386	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:64469	P	Security update for opensc (Moderate)	2021-04-13
oval:org.opensuse.security:def:73591	P	Security update for opensc (Moderate)	2021-04-13
oval:com.redhat.rhsa:def:20204483	P	RHSA-2020:4483: opensc security, bug fix, and enhancement update (Moderate)	2020-11-04

BACK