CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc

The reported issues are part of the libopensc library, which makes them accessible from OpenSC tools, PKCS#11 module, minidriver, or CTK. The attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs, so they are considered high complexity and low severity.

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. The uninitialized variables were reflected in the following functions:

• bcdmp, called from cac_list_compare_path
  • in function cac_parse_aid, code accesses path buffer by cac_list_compare_path, when function for selecting file fails (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cac.c#L1296)
  • found via fuzz_pkcs11, fuzz_pkcs15_decode
  • fixed with fdb9e903eb124b6b18a5a9350a26eceb775585bc
• cardos_lifecycle_get
  • incorrect check for error status leading into not propagating the error and usage of uninitialized value (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-cardos.c#L1284)
  • found via fuzz_pkcs11
  • fixed with 21d869b77792b6f189eebf373e399747177d99e2
• sc_pkcs15_read_file
  • incorrect checking of return value in jpki_select_file (https://github.com/OpenSC/OpenSC/blob/d5a5b5428ef1b33c71057fd173e541cdc0273485/src/libopensc/card-jpki.c#L196)
  • found via fuzz_pkcs15_encode
  • fixed with efbc14ffa190e3e0ceecceb479024bb778b0ab68

Affected versions: all before 0.26.0

Originally reported by Matteo Marini (Sapienza University of Rome)

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (3.9)