CVE-2023-40660

MEDIUM

6.6

Description

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.

Details CVE

Score CVSS v3.16.6

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaquePHYSICAL

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie11/6/2023

Derniere modification11/3/2025

Sourcenvd

Observations honeypot0

Produits affectes

opensc_project:openscredhat:enterprise_linux

Faiblesses (CWE)

CWE-287CWE-287

References

https://access.redhat.com/errata/RHSA-2023:7876(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2023:7879(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2023-40660(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2240912(secalert@redhat.com)

https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651(secalert@redhat.com)

https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1(secalert@redhat.com)

https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories(secalert@redhat.com)

http://www.openwall.com/lists/oss-security/2023/12/13/2(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2023:7876(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2023:7879(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/security/cve/CVE-2023-40660(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=2240912(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2024/12/msg00026.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.