[arch-security] [ASA-201701-12] pcsclite: privilege escalation
Jelle van der Waa
jelle at archlinux.org
Wed Jan 4 15:50:53 UTC 2017
Arch Linux Security Advisory ASA-201701-12
Date : 2017-01-04
CVE-ID : CVE-2016-10109
Package : pcsclite
Type : privilege escalation
Remote : No
Link : https://security.archlinux.org/AVG-126
The package pcsclite before version 1.8.20-1 is vulnerable to privilege
Upgrade to 1.8.20-1.
# pacman -Syu "pcsclite>=1.8.20-1"
The problem has been fixed upstream in version 1.8.20.
The SCardReleaseContext function normally releases resources associated
with the given handle (including "cardsList") and clients should cease
using this handle. A malicious client can however make the daemon
invoke SCardReleaseContext and continue issuing other commands that use
"cardsList", resulting in a use-after-free. When SCardReleaseContext is
invoked multiple times, it additionally results in a double-free of
The issue allows a local attacker to cause a denial of service, but can
potentially result in privilege escalation since the daemon is running
as root while any local user can connect to the Unix socket. Fixed by
patch "SCardReleaseContext: prevent use-after-free of cardsList" which
is released with hpcsc-lite 1.8.20 on 30 December 2016.
A local attacker is able to cause a denial of service or escalate
privileges by sending specially crafted commands to pcscd.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 488 bytes
Desc: not available
More information about the arch-security