CVE 2023 40660

CVE-2023-40660: Potential PIN bypass with empty PIN (#2806, frankmorgner/OpenSCToken#50)

When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN was provided and the token could track the login status using some of its internals. This is dangerous for OS logon/screen unlock and small tokens that are plugged permanently to the computer. The bypass was removed and OpenSC implemented explicit logout for most of the card drivers to prevent leaving unattended logged-in tokens.

The PoC is available for MacOS screen unlock bypass with Yubikey. The issue can be reproduced also with a PKCS#11 module and Minidriver if the calling applications does not bail out on empty pin (For example with Firefox. The SSSD does not allow empty PIN under Linux even before reaching out to the PKCS#11 module).

Note, that the login tracking is still useful on the pkcs15init layer so the second commit restores the similar code block in more appropriate place which could not be misused to bypass authentication on PKCS#11 layer.

Affected versions: OpenSC 0.17.0 - 0.23.0

Fixed with:

• 868f76fb31255fd3fdacfc3e476452efeb61c3e7
• 80cc5d30635f0d2c92b5099c0f9dc680d0ffce2f

Originally reported by Deepanjan Pal (Oracle Corporation)

CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (7.3)