-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 X41 D-Sec GmbH Security Advisory: X41-2018-001 Multiple Vulnerabilities in Yubico Piv ====================================== Overview - -------- Confirmed Affected Versions: 1.5.0 Confirmed Patched Versions: 1.6.0 Vendor: Yubico Vendor URL: https://www.yubico.com/ Vendor Advisory URL: https://www.yubico.com/support/security-advisories Credit: X41 D-Sec GmbH, Eric Sesterhenn Status: Public Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2018-001-Yubico-Piv/ Summary and Impact - ------------------ A buffer overflow and an out of bounds memory read were identified in the yubico-piv-tool-1.5.0, these can be triggered by a malicious token. X41 did not perform a full test or audit on the software. Product Description - ------------------- YubiKey 4, YubiKey 4 Nano, YubiKey 4C, YubiKey 4C Nano, and YubiKey NEO provide Smart Card functionality based on the Personal Identity Verification (PIV) interface specified in NIST SP 800-73, “Cryptographic Algorithms and Key Sizes for PIV.” Out of Bounds Write via Malicious APDU ====================================== Severity Rating: High Vector: APDU Response CVE: CVE-2018-14779 CWE: 120 CVSS Score: 7.1 (High) CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Summary and Impact - ------------------ File lib/ykpiv.c contains the following code in function ykpiv_transfer_data() {% highlight c %} if(*outlen + recvlen - 2 > maxout) { fprintf(stderr, "Output buffer to small, wanted to write %lu, max was %lu.", *outlen + recvlen - 2, maxout); } if(outdata) { memcpy(outdata, data, recvlen - 2); outdata += recvlen - 2; *outlen += recv_len - 2; } {% endhighlight %} It is clearly checked whether the buffer is big enough to hold the data copied using memcpy(), but no error handling happens to avoid the memcpy() in such cases. This code path can be triggered with malicious data coming from a smartcard. Workarounds - ----------- None Out of Bounds Read via malicious APDU ===================================== Severity Rating: LOW Vector: APDU Response CVE: CVE-2018-14780 CWE: 125 CVSS Score: 2.2 (Low) CVSS Vector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N Summary and Impact - ------------------ File lib/ykpiv.c contains the following code in function _ykpiv_fetch_object() {% highlight c %} if(sw == SWSUCCESS) { sizet outlen; int offs = ykpivgetlength(data + 1, &outlen); if(offs == 0) { return YKPIVSIZEERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIVOK; } else { return YKPIVGENERICERROR; } {% endhighlight %} In the end, a memmove() occurs with a length retrieved from APDU data. This length is not checked if it is outside of the APDU data retrieved. Therefore the memmove() could copy bytes behind the allocated data buffer into this buffer. Workarounds - ----------- None Timeline ======== 2018-02-03 Issues found 2018-05-22 Vendor contacted 2018-05-22 Vendor reply 2018-06-05 Requesting technical feedback from the vendor 2018-06-06 Vendor confirms bug 2018-08-01 CVE ID requested 2018-08-02 CVE ID assigned 2018-08-08 Patched version released by vendor 2018-08-11 Advisory released - -- X41 D-SEC GmbH, Dennewartstr. 25-27, D-52068 Aachen T: +49 241 9809418-0, Fax: -9 Unternehmenssitz: Aachen, Amtsgericht Aachen: HRB19989 Geschäftsführer: Markus Vervier -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEpwxVTgxAIcUvTugIo5Klpg50CxAFAlty2NwACgkQo5Klpg50 CxADgQ//UhL2gZIdimeg1HuJZRz0YcjXMvhGhZoCXOeIcw5+GGrYbnlHX0fwe5eq w9LGLYFDxvoa4ubassR9B+rFVbQ2hg9IVK1rv/VublRRjPZhMyZuGgpKjSPXptn1 /vsQ3SW75SX6c3JKKgyam5tXP/4ke3+1Xpb9W+NpXkhXtk3x78PJDSQMNXdXXWTT WsSYd7icdUI8Z96DkPUntpgbohPu2Si3G16JnHbRYKI0Mjylz6cgVkcYe6whIehq DefhoAFyIrPHPjXHr7Gy4BJnxgyEmuNBfVvNQPGd3YgxadGdozFi733Gnjoo1CAn gJl35rAL794Ww2orISm8oZXUJpTYsi53l4dS4rSFmPnj27bHDSh0s8PcmVP6K0UN 51vC/FO+1J8PRcbZdGp71ePNRYvNNwhTIecY70dn4hX12n/82V466bRGjpLXtNBM 8+0of95VcZQyJFXNNzyTvXMQVA25Lcbo0YkScwaPm6Ob1S1NtzsucojF5TlrXo7e zVAkAS9NqsWTJZVlPQIXdEpQarU8GcPW26BsjB0YpAHvsrywjWbSWLUfI7GFAAhF 25f5NH3bT8ti1wzTnEOs5/0vl9yL5IMVOcggxsT9DbirqVi4qiCPqXg+6v8GzT18 gNTz9w19ZBMehkc400u8PuBzcTlTjiSpdi2IsqaxQoxIpkg8zGw= =fNlG -----END PGP SIGNATURE-----
