CVE-2021-34193 reference

[abergmann]

MITRE published CVE-2021-34193

NVD Published Date: 08/22/2023

Description

Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.

Links

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27719
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28855  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29912  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30800  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31448  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31540  
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32149

References

https://nvd.nist.gov/vuln/detail/CVE-2021-34193

[abergmann]

Is this problem known upstream? And if yes, do we have a commit reference?

[carnil]

Not upstream here, but looking at the "new" CVE I tired to get some mapping about the fixes, apart one I have not found a reference in the commits, but which seems still to indicate that the CVE is addressed in 0.22.0-rc1:

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28185
  f015746 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28843
  1db8837 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28383
  5df913b (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27719
  78cdab9 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768
  Is there a reference for upstream fix?
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28855
  7114fb7 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29912
  1252aca (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30112
  17d8980 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30800
  ae1cf0b (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31448
  40c50a3 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31540
  40c50a3 (0.22.0-rc1)
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32149
  05648b0 (0.22.0-rc1)
  715c17c (0.22.0-rc1)

Does this make sense?

[Jakuje]

Yes, all of these were fixed in 0.22.0 release. Not sure how it surfaced just right now. I am not sure if we requested this CVE or somebody else did (probably as the information about fixed version is wrong in the CVE page). I could not find any reference to this CVE ID though before this week. @frankmorgner do you know?

I think the https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28768 is fixed with the following commit: d353a46

[frankmorgner]

In June 2022 I've requested CVEs via mitre.org, which were not processed until a couple of days ago. After many unsuccessful attempts of contacting them, we had decided to request CVEs via Red Hat for the same vulnerabilities, which resulted in the following:

• https://bugzilla.redhat.com/show_bug.cgi?id=2016083 CVE-2021-42778 opensc: Heap double free in sc_pkcs15_free_tokeninfo
• https://bugzilla.redhat.com/show_bug.cgi?id=2016086 CVE-2021-42779 opensc: Heap use after free in sc_file_valid
• https://bugzilla.redhat.com/show_bug.cgi?id=2016139 CVE-2021-42780 opensc: Use after return in insert_pin function
• https://bugzilla.redhat.com/show_bug.cgi?id=2016439 CVE-2021-42781 opensc: Heap buffer overflow in pkcs15-oberthur.c
• https://bugzilla.redhat.com/show_bug.cgi?id=2016448 CVE-2021-42782 opensc: Stack buffer overflow issues in various places

The referenced commits you found are accurate for fixing the problems. I just realized, that we forgot to mention the Red Hat CVEs in the 0.22.0 release announcement as well as adding them to the NEWS and Security advisories in the wiki 😶‍🌫️

I'm unsure how to proceed with the now "duplicated" CVE.

[Jakuje]

With the mitre having the response times of 2 years, I will contact Red Hat Product security to try to handle this somehow. Given that we have these covered, I think there needs to be a way to close it as a duplicate. And they will have much more experience with this than we do.

If you can update the release notes with the original CVE numbers, it would be great!

[ismail]

Is the understanding correct that CVE-2021-34193 is the duplicate, since it's not mentioned in the NEWS file?

[frankmorgner]

Yes, indeed. I contacted Mitre for updating the description of CVE-2021-34193.

[frankmorgner]

The public information is updated

Mitre has been contacted in a seperate CVE issue (still open/in progress). Red Hat has already added a note about the duplicate.