ALAS2023-2023-417

Amazon Linux 2023 Security Advisory: ALAS-2023-417
Advisory Release Date: 2023-10-30 23:44 Pacific
Advisory Updated Date: 2023-11-03 22:39 Pacific
Severity: Medium
Issue Overview:

Potential PIN bypass.
When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its internals. This is dangerous for OS logon/screen unlock and small tokens that are plugged permanently to the computer. (CVE-2023-40660)

multiple memory issues with pkcs15-init (enrollment tool) (CVE-2023-40661)

Out-of-bounds read in MyEID driver handling encryption using symmetric keys

This issue require physical access to the computer running opensc and crafted USB device or smart card that would present the system with specially crafted responses to the APDUs so they are considered a high-complexity and low-severity.

This issue is in the code handling symmetric keys, which are not widely used for example for desktop login so most of the deployments are not affected. (CVE-2023-4535)


Affected Packages:

opensc


Issue Correction:
Run dnf update opensc --releasever 2023.2.20231030 to update your system.

New Packages:
aarch64:
    opensc-debugsource-0.23.0-3.amzn2023.0.2.aarch64
    opensc-debuginfo-0.23.0-3.amzn2023.0.2.aarch64
    opensc-0.23.0-3.amzn2023.0.2.aarch64

src:
    opensc-0.23.0-3.amzn2023.0.2.src

x86_64:
    opensc-debuginfo-0.23.0-3.amzn2023.0.2.x86_64
    opensc-0.23.0-3.amzn2023.0.2.x86_64
    opensc-debugsource-0.23.0-3.amzn2023.0.2.x86_64

Additional References

Red Hat: CVE-2023-40660, CVE-2023-40661, CVE-2023-4535

Mitre: CVE-2023-40660, CVE-2023-40661, CVE-2023-4535