CVE-2018-20340
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious...
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
CVE-2018-20340- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
CVE-2018-20340- Updated
- 2026-11-02
EUVDEUVD-2018-12898 No score
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
EUVD-2018-12898- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rc58-rfcj-mcrr
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious...
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
GHSA-rc58-rfcj-mcrr- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
CVE-2018-20340- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20340
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
DEBIAN-CVE-2018-20340- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2018-20340
Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.
- Record
UBUNTU-CVE-2018-20340- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1475-1 No score
Security update for libu2f-host
This update for libu2f-host fixes the following issues:
Security issue fixed:
- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1475-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0799-1 No score
Security update for libu2f-host
This update for libu2f-host fixes the following issues:
This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)
Version 1.1.10 (released 2019-05-15)
- Add new devices to udev rules.
- Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140)
Version 1.1.9 (released 2019-03-06)
- Fix CID copying from the init response, which broke compatibility with some devices.
Version 1.1.8 (released 2019-03-05)
- Add udev rules
- Drop 70-old-u2f.rules and use 70-u2f.rules for everything
- Use a random nonce for setting up CID to prevent fingerprinting
- CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140).
Version 1.1.7 (released 2019-01-08)
-
Fix for trusting length from device in device init.
-
Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781)
-
Add udev rules for some new devices.
-
Add udev rule for Feitian ePass FIDO
- Add a timeout to the register and authenticate actions. This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0799-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1755-1 No score
Security update for libu2f-host
This update for libu2f-host fixes the following issues:
This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)
Version 1.1.10 (released 2019-05-15)
- Add new devices to udev rules.
- Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140)
Version 1.1.9 (released 2019-03-06)
- Fix CID copying from the init response, which broke compatibility with some devices.
Version 1.1.8 (released 2019-03-05)
- Add udev rules
- Drop 70-old-u2f.rules and use 70-u2f.rules for everything
- Use a random nonce for setting up CID to prevent fingerprinting
- CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140).
Version 1.1.7 (released 2019-01-08)
-
Fix for trusting length from device in device init.
-
Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781)
-
Add udev rules for some new devices.
-
Add udev rule for Feitian ePass FIDO
- Add a timeout to the register and authenticate actions.
- Record
openSUSE-SU-2021:1755-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1340-1 No score
Security update for libu2f-host
This update for libu2f-host fixes the following issues:
Security issue fixed:
- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).
- Record
SUSE-SU-2019:1340-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1749-1 No score
Security update for libu2f-host
This update for libu2f-host and pam_u2f to version 1.0.8 fixes the following issues:
Security issues fixed for libu2f-host:
- CVE-2019-9578: Fixed a memory leak due to a wrong parse of init's response (bsc#1128140).
- CVE-2018-20340: Fixed an unchecked buffer, which could allow a buffer overflow with a custom made malicious USB device (bsc#1124781).
Security issues fixed for pam_u2f:
- CVE-2019-12209: Fixed an issue where symlinks in the user's directory were followed (bsc#1135729).
- CVE-2019-12210: Fixed file descriptor leaks (bsc#1135727).
- Record
SUSE-SU-2019:1749-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1755-1 No score
Security update for libu2f-host
This update for libu2f-host fixes the following issues:
This update ships the u2f-host package (jsc#ECO-3687 bsc#1184648)
Version 1.1.10 (released 2019-05-15)
- Add new devices to udev rules.
- Fix a potentially uninitialized buffer (CVE-2019-9578, bsc#1128140)
Version 1.1.9 (released 2019-03-06)
- Fix CID copying from the init response, which broke compatibility with some devices.
Version 1.1.8 (released 2019-03-05)
- Add udev rules
- Drop 70-old-u2f.rules and use 70-u2f.rules for everything
- Use a random nonce for setting up CID to prevent fingerprinting
- CVE-2019-9578: Parse the response to init in a more stable way to prevent leakage of uninitialized stack memory back to the device (bsc#1128140).
Version 1.1.7 (released 2019-01-08)
-
Fix for trusting length from device in device init.
-
Fix for buffer overflow when receiving data from device. (YSA-2019-01, CVE-2018-20340, bsc#1124781)
-
Add udev rules for some new devices.
-
Add udev rule for Feitian ePass FIDO
- Add a timeout to the register and authenticate actions.
- Record
SUSE-SU-2021:1755-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libu2f-hostDebian:12 |
before 1.1.7-1 | 1.1.7-1 |
libu2f-hostDebian:13 |
before 1.1.7-1 | 1.1.7-1 |
libu2f-hostDebian:14 |
before 1.1.7-1 | 1.1.7-1 |
libu2f-hostDebian:9 |
before 1.1.2-2+deb9u1, plus listed versions 1.1.2-2 |
1.1.2-2+deb9u1 |
libu2f-hostSUSE:Linux Enterprise Module for Basesystem 15 |
before 1.1.6-3.3.3 | 1.1.6-3.3.3 |
libu2f-hostSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
pam_u2fSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
pam_u2fSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 1.1.6-3.5.1 | 1.1.6-3.5.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pam_u2fSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 4 CVEs |
before 1.0.8-3.3.1 | 1.0.8-3.3.1 |
libu2f-hostSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 1.1.10-3.9.1 | 1.1.10-3.9.1 |
libu2f-hostSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 1.1.10-3.9.1 | 1.1.10-3.9.1 |
libu2f-hostUbuntu:16.04:LTS |
All versions, plus listed versions 0.0.4-11.0.0-1 |
None known |
libu2f-hostUbuntu:18.04:LTS |
before 1.1.4-1ubuntu0.1, plus listed versions 1.1.3-11.1.4-1 |
1.1.4-1ubuntu0.1 |
libu2f-hostopenSUSE:Leap 15.0 |
before 1.1.6-lp151.2.3.1 | 1.1.6-lp151.2.3.1 |
libu2f-hostopenSUSE:Leap 15.1 |
before 1.1.6-lp151.2.3.1 | 1.1.6-lp151.2.3.1 |
libu2f-hostopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 1.1.10-lp152.4.3.1 | 1.1.10-lp152.4.3.1 |
libu2f-hostopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.1.10-3.9.1 | 1.1.10-3.9.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20340 is a medium vulnerability (CVSS 6.8) in Yubico Libu2f-host, published February 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in libu2f-host 1.1.7-1.
References
seclists.org/bugtraq/2019/Feb/23
debian.org/security/2019/dsa-4389
yubico.com/support/security-advisories/ysa-2019-01
developers.yubico.com/libu2f-host/Release_Notes.html
blog.inhq.net/posts/yubico-libu2f-host-vuln-part1
security.gentoo.org/glsa/202004-15
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-20340
github.com/advisories/GHSA-rc58-rfcj-mcrr
security-tracker.debian.org/tracker/CVE-2018-20340
suse.com/support/update/announcement/2019/suse-su-20191340-1
bugzilla.suse.com/1124781
ubuntu.com/security/CVE-2018-20340
cve.org/CVERecord?id=CVE-2018-20340
lists.opensuse.org/archives/list/[email protected]/thread/EQ36UOSV6ZRKJLN2XKDNYOB7MKQAPYUE