CVE-2023-2977 Memory corruption in OpenSC
A heap-based buffer over-read in OpenSC allows attackers to cause crashes or leak information via a malformed smart card package.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2977?
CVE-2023-2977 is a high-severity memory corruption vulnerability in Opensc Project Opensc, published on 1 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible.
Which versions are affected by CVE-2023-2977?
It affects 2 products.
Linux distribution packages (21)
opensc AlmaLinux:8 | All versions | 0.20.0-6.el8 |
opensc AlmaLinux:9 | All versions | 0.23.0-2.el9 |
opensc Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-6.el8 |
opensc-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-6.el8 |
opensc-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:0.20.0-6.el8 |
opensc Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-2.el9 |
opensc-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-2.el9 |
opensc-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:0.23.0-2.el9 |
opensc SUSE:Linux Enterprise Micro 5.1 | All versions | 0.19.0-150100.3.22.1 |
opensc SUSE:Linux Enterprise Micro 5.2 | All versions | 0.19.0-150100.3.22.1 |
opensc SUSE:Linux Enterprise Micro 5.3 | All versions | 0.22.0-150400.3.3.1 |
opensc SUSE:Linux Enterprise Micro 5.4 | All versions | 0.22.0-150400.3.3.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 0.22.0-150400.3.3.1 |
opensc SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.22.0-150400.3.3.1 |
opensc SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 0.19.0-150100.3.22.1 |
opensc SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.13.0-3.22.1 |
opensc SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.13.0-3.22.1 |
opensc openSUSE:Leap 15.4 | All versions | 0.22.0-150400.3.3.1 |
opensc openSUSE:Leap 15.5 | All versions | 0.22.0-150400.3.3.1 |
opensc openSUSE:Leap Micro 5.3 | All versions | 0.22.0-150400.3.3.1 |
opensc openSUSE:Tumbleweed | All versions | 0.23.0-2.1 |
Products include Opensc Project Opensc, Redhat Enterprise Linux.
How do I fix CVE-2023-2977?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-2977 being exploited?
There is no known exploitation of CVE-2023-2977 in the wild and no public exploit code.
Other vulnerabilities in Opensc Project Opensc
Sources
Also known as ALSA-2023:6587, ALSA-2023:7160, AZL-27012, AZL-35073, BELL-CVE-2023-2977, CLSA-2025-1760022476 and 12 more.