Vulnerability · Published Nov 6, 2023 · Assigned by redhat
CVE-2023-40660Opensc: potential pin bypass when card tracks its own login state
Medium 6.6
In plain English
A medium-severity improper authentication in OpenSC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | opensc | 0.20.0-7.el8_9 | ALSA-2023:7876 |
| AlmaLinux:9 | opensc | 0.23.0-3.el9_3 | ALSA-2023:7879 |
| Alpine:v3.20 | opensc | 0.24.0-r0 | ALPINE-CVE-2023-40660 |
| Alpine:v3.21 | opensc | 0.24.0-r0 | ALPINE-CVE-2023-40660 |
| Alpine:v3.22 | opensc | 0.24.0-r0 | ALPINE-CVE-2023-40660 |
| Alpine:v3.23 | opensc | 0.24.0-r0 | ALPINE-CVE-2023-40660 |
| Alpine:v3.24 | opensc | 0.24.0-r0 | ALPINE-CVE-2023-40660 |
| Debian:12 | opensc | 0.23.0-0.3+deb12u1 | DEBIAN-CVE-2023-40660 |
| Debian:13 | opensc | 0.23.0-2 | DEBIAN-CVE-2023-40660 |
| Debian:14 | opensc | 0.23.0-2 | DEBIAN-CVE-2023-40660 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenSC | 0.17.0 – before 0.24.0 | |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2023:7876 vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7879 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-40660 vdb-entry, x_refsource_REDHAT
- RHBZ#2240912 issue-tracking, x_refsource_REDHAT
- https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
- https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
- https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
- http://www.openwall.com/lists/oss-security/2023/12/13/2 x_transferred
- https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/ x_transferred
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/ x_transferred
- https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html