CVE-2016-10109

What it actually does

Use-after-free condition in pcsc-lite triggered when a command references the cardsList structure after SCardReleaseContext has already freed the associated handle, resulting in a crash.

Why it matters to the business

Systems relying on smart-card or PC/SC-based authentication experience sudden service interruption and loss of availability, potentially halting access to protected resources until the daemon is restarted.

How an attack unfolds

An attacker establishes a PC/SC context, issues SCardReleaseContext to free the handle, then immediately sends a subsequent command that dereferences the now-freed cardsList object, causing the daemon to crash.

How to fix it

Upgrade pcsc-lite to version 1.8.20 or later on all affected systems; rebuild or reinstall any packages that statically link against the vulnerable library.

How to confirm the fix worked

Verify the installed pcsc-lite version is 1.8.20 or newer; attempt to reproduce the crash sequence in a test environment to confirm the flaw is no longer present.

Typical attack path

1. Connect to the pcsc-lite daemon over its local IPC interface
2. Obtain a valid context handle via SCardEstablishContext
3. Call SCardReleaseContext to release and free the handle
4. Send a follow-up command that accesses the cardsList structure
5. Trigger the use-after-free and observe daemon crash or restart

How to detect it

Review system logs for unexpected pcscd process crashes or restarts around the time of suspected activity; correlate with any external connections or API calls to the PC/SC daemon.

What your security team should do

• Prioritize patching pcsc-lite to 1.8.20+ on internet-facing or high-value systems within the next maintenance window
• Inventory all hosts running pcsc-lite or dependent smart-card services and schedule upgrades
• Monitor daemon restart rates and availability alerts for the affected service
• Consider isolating PC/SC-dependent workloads until patches are applied