CVE-2018-14780 (GCVE-0-2018-14780)

Vulnerability from cvelistv5 – Published: 2018-08-15 18:00 – Updated: 2024-08-05 09:38
VLAI?
Summary
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:38:13.975Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.yubico.com/support/security-advisories/ysa-2018-03/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/"
          },
          {
            "name": "[oss-security] 20180814 X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple Vulnerabilities in Yubico Piv",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2018/08/14/2"
          },
          {
            "name": "USN-4276-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4276-1/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-25T03:06:21",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.yubico.com/support/security-advisories/ysa-2018-03/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/"
        },
        {
          "name": "[oss-security] 20180814 X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple Vulnerabilities in Yubico Piv",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2018/08/14/2"
        },
        {
          "name": "USN-4276-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4276-1/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-14780",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.yubico.com/support/security-advisories/ysa-2018-03/",
              "refsource": "CONFIRM",
              "url": "https://www.yubico.com/support/security-advisories/ysa-2018-03/"
            },
            {
              "name": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/",
              "refsource": "MISC",
              "url": "https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/"
            },
            {
              "name": "[oss-security] 20180814 X41 D-Sec GmbH Security Advisory X41-2018-001: Multiple Vulnerabilities in Yubico Piv",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2018/08/14/2"
            },
            {
              "name": "USN-4276-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4276-1/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-14780",
    "datePublished": "2018-08-15T18:00:00",
    "dateReserved": "2018-08-01T00:00:00",
    "dateUpdated": "2024-08-05T09:38:13.975Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-14780\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-08-15T18:29:00.887\",\"lastModified\":\"2024-11-21T03:49:46.553\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, \u0026outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto una vulnerabilidad de lectura fuera de l\u00edmites en el controlador de tarjetas inteligentes de Yubico-Piv 1.5.0. El archivo lib/ykpiv.c contiene el siguiente c\u00f3digo en la funci\u00f3n \\\"_ykpiv_fetch_object()\\\": {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- Al final, ocurre un \\\"memmove()\\\" con una longitud recuperada de los datos APDU. No se comprueba si la longitud es de fuera de los datos APDU recuperados. Por lo tanto, \\\"memmove()\\\" podr\u00eda copiar bytes de detr\u00e1s del b\u00fafer de datos asignado en este b\u00fafer.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.2\",\"matchCriteriaId\":\"1E9E1480-3B52-4116-A0AC-6D40EF27C705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78648DEA-0B05-450B-9B69-5A90E0F03B12\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2b:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F27386DA-D798-442B-AB7A-9F3A8D5298E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2c:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA320FD3-AE57-4CC3-A00B-915CAE53A9CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2d:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DCA5A56-4979-4981-ABDC-F6243FEDAA48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2e:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6ABF3B7-521E-42C4-85A9-A867BE87F8E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2f:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A9DE0A5-2B2D-4669-89F2-306C97445ADB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_manager:1.4.2g:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A6DCD14-7271-40E3-A9C5-B20EFF6B7495\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:piv_tool:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.6.0\",\"matchCriteriaId\":\"B3DA5613-3B1C-434A-950B-101FE9BEE7A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yubico:smart_card_minidriver:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.7.3.160\",\"matchCriteriaId\":\"60A34CF9-F5B7-4874-961D-22915C55D60F\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2018/08/14/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4276-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.yubico.com/support/security-advisories/ysa-2018-03/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2018/08/14/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4276-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.yubico.com/support/security-advisories/ysa-2018-03/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.