Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Yubico PIV tools may read beyond memory, causing data leak

CVE-2018-14780 · published 8 years ago
Summary

Version 1.5.0 of the Yubico PIV manager, tool, and smart‑card driver can copy data from outside the intended memory area. This could allow private information stored in the program to be exposed or cause the program to behave unexpectedly. Install the latest update from Yubico or apply the vendor’s recommended patch as soon as possible.

What to do
  • Update yubico piv_manager to version 1.4.2 or later.
  • Update yubico piv_tool to version 1.6.0 or later.
Affected software
VendorProductAffected versions
yubico piv_manager < 1.4.2
1.4.2
1.4.2b
1.4.2c
1.4.2d
1.4.2e
1.4.2f
1.4.2g
cpe:2.3:a:yubico:piv_manager:*:*:*:*:*:*:*:*
yubico piv_tool < 1.6.0
cpe:2.3:a:yubico:piv_tool:*:*:*:*:*:*:*:*
yubico smart_card_minidriver <= 3.7.3.160
cpe:2.3:a:yubico:smart_card_minidriver:*:*:*:*:*:*:*:*
Original advisory text
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(s...
An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_fetch_object()`: {% highlight c %} if(sw == SW_SUCCESS) { size_t outlen; int offs = _ykpiv_get_length(data + 1, &outlen); if(offs == 0) { return YKPIV_SIZE_ERROR; } memmove(data, data + 1 + offs, outlen); *len = outlen; return YKPIV_OK; } else { return YKPIV_GENERIC_ERROR; } {% endhighlight %} -- in the end, a `memmove()` occurs with a length retrieved from APDU data. This length is not checked for whether it is outside of the APDU data retrieved. Therefore the `memmove()` could copy bytes behind the allocated data buffer into this buffer.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published15 Aug 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-14780 · NVD
Track software like this
Free during beta