// For flags

CVE-2020-13131

 

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-tool) does not properly check embedded length fields during device communication. A malicious PIV token can misreport the returned length fields during RSA key generation. This will cause stack memory to be copied into heap allocated memory that gets returned to the caller. The leaked memory could include PINs, passwords, key material, and other sensitive information depending on the integration. During further processing by the caller, this information could leak across trust boundaries. Note that RSA key generation is triggered by the host and cannot directly be triggered by the token.

Se detectó un problema en Yubico libykpiv versiones anteriores a 2.1.0. La biblioteca lib/util.c (que es incluida en yubico-piv-tool) no comprueba apropiadamente los campos de longitud incorporados durante la comunicación del dispositivo. Un token PIV malicioso puede reportar erróneamente los campos de longitud devueltos durante la generación de claves RSA. Esto causará que la memoria stack sea copiada en la memoria asignada de heap que se devuelve a la persona que llama. La memoria filtrada podría incluir PIN, contraseñas, material clave y otra información confidencial dependiendo de la integración. Durante el procesamiento posterior por parte de la persona que llama, esta información podría filtrarse a través de límites de confianza. Tome en cuenta que la generación de claves RSA es desencadenada por el host y no puede ser desencadenada directamente por el token

*Credits: N/A
CVSS Scores
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-05-18 CVE Reserved
  • 2020-07-09 CVE Published
  • 2023-11-12 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Yubico
Search vendor "Yubico"
 Libykpiv
Search vendor "Yubico" for product "Libykpiv"
 < 2.1.0
Search vendor "Yubico" for product "Libykpiv" and version " < 2.1.0"
-
Affected
Yubico
Search vendor "Yubico"
 Piv Tool Manager
Search vendor "Yubico" for product "Piv Tool Manager"
 < 2.0.0
Search vendor "Yubico" for product "Piv Tool Manager" and version " < 2.0.0"
-
Affected
Yubico
Search vendor "Yubico"
 Yubikey Smart Card Minidriver
Search vendor "Yubico" for product "Yubikey Smart Card Minidriver"
 <= 4.1.0.172
Search vendor "Yubico" for product "Yubikey Smart Card Minidriver" and version " <= 4.1.0.172"
-
Affected