CVE-2018-14780
Description
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.
How to fix
- yubico piv_manager1.4.2 or later
- yubico piv_tool1.6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yubico smart_card_minidriver | v ≤ 3.7.3.160 | — |
| yubico piv_manager | v < 1.4.2, 1.4.2, 1.4.2b, 1.4.2c, 1.4.2d, 1.4.2e, 1.4.2f, 1.4.2g | 1.4.2 |
| yubico piv_tool | v < 1.6.0 | 1.6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.