CVE-2024-45617: opensc_project opensc Use of Uninitialized Variable

Vulnerability summary

CVE-2024-45617 is a low (CVSS 3.9) Use of Uninitialized Variable vulnerability in opensc_project opensc. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Timeline

1. 03-09-2024
   PublishedVulnerability first disclosed.
2. 30-06-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.

• CWE-457Use of Uninitialized VariableThe code uses a variable that has not been initialized, leading to unpredictable or unintended results.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.