Out-of-bounds Read in Yubico Libykpiv
CVE-2020-13131
An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (40.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
Weakness classification (CWE)
References
- blog.inhq.net/posts/yubico-libykpiv-vuln/ (Exploit, Third Party Advisory)
- www.yubico.com/products/services-software/download/smart-card-drivers-tools/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-13131?
- CVE-2020-13131 is a medium-severity vulnerability in Yubico Libykpiv, classified under Out-of-bounds Read. CVSS score: 4.3/10. Published 2020-07-09.
- How severe is CVE-2020-13131?
- Medium severity. CVSS v3 base score is 4.3 out of 10.