Use After Free in Opensc Project
CVE-2024-1454
The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
Vulnerability class: Use-After-Free
EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.4 (Low). Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Opensc_project Opensc
- Fedoraproject Fedora — versions 38, 39, 40
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Redhat Enterprise_linux — versions 7.0, 8.0, 9.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, Third Party Advisory, vdb-entry)
- secalert@redhat.com (Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (Patch)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-1454?
- CVE-2024-1454 is a low-severity vulnerability in Opensc Project, classified under Use After Free. CVSS score: 3.4/10. Published 2024-02-12.
- How severe is CVE-2024-1454?
- Low severity. CVSS v3 base score is 3.4 out of 10.
- Is CVE-2024-1454 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.