CVE-2024-1454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1454
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

3.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.4 / Impact : 2.7

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://access.redhat.com/security/cve/CVE-2024-1454 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2263929 Issue Tracking Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 Patch
https://access.redhat.com/security/cve/CVE-2024-1454 Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2263929 Issue Tracking Third Party Advisory
https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/
Configurations

Configuration 1 (hide)

cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:50

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ -
References () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory
References () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch

06 Nov 2024, 15:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}

16 Oct 2024, 13:57

Type Values Removed Values Added
First Time Redhat enterprise Linux
Opensc Project opensc
Fedoraproject fedora
Redhat
Fedoraproject
Opensc Project
References () https://access.redhat.com/security/cve/CVE-2024-1454 - () https://access.redhat.com/security/cve/CVE-2024-1454 - Third Party Advisory
References () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - () https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 - Issue Tracking
References () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - () https://bugzilla.redhat.com/show_bug.cgi?id=2263929 - Issue Tracking, Third Party Advisory
References () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - () https://github.com/OpenSC/OpenSC/commit/5835f0d4f6c033bd58806d33fa546908d39825c9 - Patch
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ - Mailing List, Third Party Advisory
CPE cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:opensc_project:opensc:*:*:*:*:*:*:*:*

23 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UECKC7X4IM4YZQ5KRQMNBNKNOXLZC7RZ/ -

16 Mar 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJI2FWLY24EOPALQ43YPQEZMEP3APPPI/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OWIZ5ZLO5ECYPLSTESCF7I7PQO5X6ZSU/ -

12 Feb 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-12 23:15

Updated : 2024-11-21 08:50

NVD link : CVE-2024-1454

Mitre link : CVE-2024-1454

CVE.ORG link : CVE-2024-1454

JSON object : View

Products Affected

redhat

  • enterprise_linux

opensc_project

  • opensc

fedoraproject

  • fedora
CWE
CWE-416

Use After Free