CVE-2024-45619

What it actually does

The vulnerability allows an attacker with physical access to a crafted USB device or smart card to cause the OpenSC library to access uninitialized or incorrectly handled buffer contents during APDU response processing, potentially leading to information disclosure or limited integrity/availability impacts.

Why it matters to the business

Organizations relying on smart card authentication may face risks of data leakage or system instability if an attacker gains physical access to insert a malicious device, though remote exploitation is not possible.

How an attack unfolds

An attacker crafts a USB device or smart card that responds to APDU commands with specially formatted data that partially fills buffers. This leads to the OpenSC PKCS#11 module or minidriver incorrectly accessing initialized parts of the buffer.

How to fix it

Update OpenSC to the fixed commit fe857cc4c68da4873071f168c9aaf9860040ff4e or later versions that address the buffer handling in APDU responses.

How to confirm the fix worked

Verify the installed OpenSC version includes the commit fe857cc4c68da4873071f168c9aaf9860040ff4e and test with known good smart cards.

Typical attack path

1. Gain physical access to the target system
2. Insert crafted USB/smart card
3. Trigger APDU exchanges via OpenSC tools or applications
4. Exploit buffer mishandling to access unintended data

How to detect it

Review system logs for unusual smart card interactions or errors in OpenSC during APDU processing; check for unexpected data access patterns in applications using PKCS#11.

What your security team should do

• Apply the patch immediately if using OpenSC with smart cards
• Restrict physical access to systems using smart card readers
• Monitor for any physical security incidents