Every CVE Search/ Get API key

CVE-2024-1454

Opensc: memory use after free in authentic driver when updating token info

3.4 LowFix available

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.42%Up 0.4 points since Feb 13, 2024
90%50%10%1%

What each source reports

CVE List Score used 3.4

Opensc: memory use after free in authentic driver when updating token info

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-416
Updated
2026-11-06
EUVDEUVD-2024-17206 3.4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
EUVD-2024-17206
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-06
GitHub AdvisoriesGHSA-6q4q-mhg5-v6xh 3.4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring...

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
GHSA-6q4q-mhg5-v6xh
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-416
Updated
2026-11-02
NVD 3.4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-416
Updated
2026-11-06
OSVALPINE-CVE-2024-1454 3.4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
ALPINE-CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSVAZL-34384 3.4

CVE-2024-1454 affecting package opensc for versions less than 0.23.0-4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
AZL-34384
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVAZL-35078 3.4

CVE-2024-1454 affecting package opensc for versions less than 0.25.1-3

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
AZL-35078
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVBELL-CVE-2024-1454 3.4
Record
BELL-CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSV 3.4

Opensc: memory use after free in authentic driver when updating token info

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-416
Updated
2026-11-07
OSVDEBIAN-CVE-2024-1454 3.4

The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.

Record
DEBIAN-CVE-2024-1454
CVSS 3.1
3.4 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-07
OSVopenSUSE-SU-2024:13733-1 No score

opensc-0.24.0-2.1 on GA media

These are all security issues fixed in the opensc-0.24.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13733-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensc
Alpine:v3.20
 before 0.25.1-r0
0.25.1-r0
opensc
Alpine:v3.21
 before 0.25.1-r0
0.25.1-r0
opensc
Alpine:v3.22
 before 0.25.1-r0
0.25.1-r0
opensc
Alpine:v3.23
 before 0.25.1-r0
0.25.1-r0
opensc
Alpine:v3.24
 before 0.25.1-r0
0.25.1-r0
opensc
Azure Linux:2
 before 0.23.0-4
0.23.0-4
opensc
Azure Linux:3
 before 0.25.1-3
0.25.1-3
opensc
Alpaquita:23
 0.22.0-r4 up to 0.26.0-r0
0.26.0-r0
opensc
Alpaquita:stream
 0.22.0-r3 up to 0.25.1-r0
0.25.1-r0
opensc
Debian:12
 before 0.23.0-0.3+deb12u2, plus listed versions
0.23.0-0.30.23.0-0.3+deb12u1
0.23.0-0.3+deb12u2
Show 4 moreShow less
Affected packages
PackageAffectedFixed
opensc
Debian:13
 before 0.25.0~rc1-1
0.25.0~rc1-1
opensc
Debian:14
 before 0.25.0~rc1-1
0.25.0~rc1-1
opensc
Debian:11
From an advisory covering 18 CVEs
 before 0.21.0-1+deb11u1, plus listed versions
0.21.0-1
0.21.0-1+deb11u1
opensc
openSUSE:Tumbleweed
 before 0.24.0-2.1
0.24.0-2.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-1454 is a low vulnerability (CVSS 3.4) in Opensc Project Opensc, published February 12, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in opensc 0.25.1-r0.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open