CVEvulnerability

CVE-2024-1454

3.4 LOW Published 2024-02-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-02-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.4 LOW — CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 ([email protected])
3.4 LOW — CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-416

Description

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Affected configurations

• opensc project opensc (< 0.25.0) • fedoraproject fedora 38 • fedoraproject fedora 39 • fedoraproject fedora 40 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0

Related

Weakness · CWE (1)

References