IASECC: error when getting access to 2F00

[vjardin]

Problem Description

From time to time, openSC fails with the APDU sequence:

      00000200 [139681798813440] APDU: 00 A4 09 04 02 2F 00
      00029790 [139681798813440] SW: 6A 82

In order to reproduce this issue, I need to dump all the objects of a CPX card using C_GetAttributeValue(). Then, on some objects, I get an error because we get the SW 6A 82.

[vjardin]

The current patch does not revert the memmove() since it seems to be required for some cards ; but it skips it only for the CPX cards.

[vjardin]

For the records, CVE-2018-16426 https://vuldb.com/?id.123550

[frankmorgner]

what does it mean to fail from time to time? can you reliably reproduce this, is this related to a specific object? If not, this may be due to path caching. If so, path caching should be disabled instead...

[vjardin]

I tried both with and without cache, I faced the same issue. "from time to time" means that over a long sequence of APDUs including this command, I do not have the return'd values 6A 82. If 3F00 is not removed, then, it always work for any sequence.

[frankmorgner]

So can you reproduce the result reliably by issuing the same long sequence of commands, or not?

please note that with cache, I mean card->cache, which cannot be disabled by the configuration file. it is not related to the file cache from opensc.conf

[vjardin]

I'll check this card->cache, I did only disable the cache from the configuration file.

[frankmorgner]

card->cache remembers which path has been selected previously to avoid unnecessary commands. If some other process accesses the card while it is unlocked, this path may get invalidated without being noticed. That's why, I think, the concept of keeping card->cache is a misconception in a concurrent environment... Unfortunately I never had the time to go for a generic fix, but you may need to disable it here for your card to avoid these kinds of problems.

[frankmorgner]

If concurrency is the reason for your problems while selecting the path, you can also lock the card once you start the selection process:

1. lock the card
2. select MF (3F00)
3. select the rest of the path (path - 3F00)
4. unlock the card

This avoids being interrupted by a different process. You need to take care to catch all error cases to correctly unlock the card.

[vjardin]

merged => fixed.