CVE-2023-40660

CVSS V2 None CVSS V3 None
Description
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock and for small, permanently connected tokens to computers. Additionally, the token can internally track login status. This flaw allows an attacker to gain unauthorized access, carry out malicious actions, or compromise the system without the user's awareness.
Overview
  • CVE ID
  • CVE-2023-40660
  • Assigner
  • redhat
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-11-06T16:58:42.939Z
  • Last Modified Date
  • 2024-05-01T20:21:01.533Z
Weakness Enumerations
CWE URL
CWE-287 http://cwe.mitre.org/data/definitions/287.html
References
Reference URL Reference Tags
http://www.openwall.com/lists/oss-security/2023/12/13/2
https://access.redhat.com/errata/RHSA-2023:7876 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:7879 vendor-advisory x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-40660 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2240912 issue-tracking x_refsource_REDHAT
https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651
https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1
https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories
https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-40660
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40660
History
Created Old Value New Value Data Type Notes
2024-06-25 02:02:15 Added to TrackCVE