OpenSC Stack Buffer Overflow Vulnerability in PIV History Processing

A stack buffer overflow vulnerability has been identified in OpenSC versions prior to 0.27.0-rc1. The issue, located in the 'piv_process_history()' function within 'src/libopensc/card-piv.c', allows physically present attackers to cause memory corruption. This is achieved by presenting a crafted PIV smart card or USB device that returns a URL field longer than 118 bytes in the Key History Object ASN.1 response.

Impact

Exploitation of this vulnerability leads to memory corruption, which can potentially be exploited to execute arbitrary code.

Remediation

Users can upgrade to OpenSC version 0.27.0-rc1 or later to address this vulnerability.