[meta-oe,1/2] opensc: Fix CVE-2023-40660

From: virendra thakur <virendrak@kpit.com>

Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533]

Signed-off-by: virendra thakur <virendrak@kpit.com>
---
 .../opensc/opensc/CVE-2023-40660.patch        | 55 +++++++++++++++++++
 .../recipes-support/opensc/opensc_0.20.0.bb   |  1 +
 2 files changed, 56 insertions(+)
 create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2023-40660.patch

On 12/21/23 4:15 AM, virendra thakur wrote:
> From: virendra thakur <virendrak@kpit.com>
> 
> Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533]
> 
> Signed-off-by: virendra thakur <virendrak@kpit.com>

Please indicate the branch it is intended for in the subject field to 
get proper attention, something like ...

[branch][layer] recipe: Summary of change ....



> ---
>   .../opensc/opensc/CVE-2023-40660.patch        | 55 +++++++++++++++++++
>   .../recipes-support/opensc/opensc_0.20.0.bb   |  1 +
>   2 files changed, 56 insertions(+)
>   create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2023-40660.patch
> 
> diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2023-40660.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2023-40660.patch
> new file mode 100644
> index 000000000..74e547298
> --- /dev/null
> +++ b/meta-oe/recipes-support/opensc/opensc/CVE-2023-40660.patch
> @@ -0,0 +1,55 @@
> +Origin: https://github.com/OpenSC/OpenSC/commit/868f76fb31255fd3fdacfc3e476452efeb61c3e7
> +From: Frank Morgner <frankmorgner@gmail.com>
> +Date: Wed, 21 Jun 2023 12:27:23 +0200
> +Subject: Fixed PIN authentication bypass
> +
> +If two processes are accessing a token, then one process may leave the
> +card usable with an authenticated PIN so that a key may sign/decrypt any
> +data. This is especially the case if the token does not support a way of
> +resetting the authentication status (logout).
> +
> +We have some tracking of the authentication status in software via
> +PKCS#11, Minidriver (os-wise) and CryptoTokenKit, which is why a
> +PIN-prompt will appear even though the card may technically be unlocked
> +as described in the above example. However, before this change, an empty
> +PIN was not verified (likely yielding an error during PIN-verification),
> +but it was just checked whether the PIN is authenticated. This defeats
> +the purpose of the PIN verification, because an empty PIN is not the
> +correct one. Especially during OS Logon, we don't want that kind of
> +shortcut, but we want the user to verify the correct PIN (even though
> +the token was left unattended and authentication at the computer).
> +
> +This essentially reverts commit e6f7373ef066cfab6e3162e8b5f692683db23864.
> +
> +CVE: CVE-2023-40660
> +Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533]
> +Signed-off-by: Virendra Thakur <virendrak@kpit.com>
> +---
> + src/libopensc/pkcs15-pin.c | 13 -------------
> + 1 file changed, 13 deletions(-)
> +
> +diff --git a/src/libopensc/pkcs15-pin.c b/src/libopensc/pkcs15-pin.c
> +index 80a185fecd..393234efe4 100644
> +--- a/src/libopensc/pkcs15-pin.c
> ++++ b/src/libopensc/pkcs15-pin.c
> +@@ -307,19 +307,6 @@
> + 		LOG_FUNC_RETURN(ctx, SC_ERROR_INVALID_PIN_REFERENCE);
> + 	auth_info = (struct sc_pkcs15_auth_info *)pin_obj->data;
> +
> +-	/*
> +-	 * if pin cache is disabled, we can get here with no PIN data.
> +-	 * in this case, to avoid error or unnecessary pin prompting on pinpad,
> +-	 * check if the PIN has been already verified and the access condition
> +-	 * is still open on card.
> +-	 */
> +-	if (pinlen == 0) {
> +-	    r = sc_pkcs15_get_pin_info(p15card, pin_obj);
> +-
> +-	    if (r == SC_SUCCESS && auth_info->logged_in == SC_PIN_STATE_LOGGED_IN)
> +-		LOG_FUNC_RETURN(ctx, r);
> +-	}
> +-
> + 	r = _validate_pin(p15card, auth_info, pinlen);
> +
> + 	if (r)
> +
> diff --git a/meta-oe/recipes-support/opensc/opensc_0.20.0.bb b/meta-oe/recipes-support/opensc/opensc_0.20.0.bb
> index b8cf203b7..3e77b8884 100644
> --- a/meta-oe/recipes-support/opensc/opensc_0.20.0.bb
> +++ b/meta-oe/recipes-support/opensc/opensc_0.20.0.bb
> @@ -14,6 +14,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=7fbc338309ac38fefcd64b04bb903e34"
>   #v0.19.0
>   SRCREV = "45e29056ccde422e70ed3585084a7f150c632515"
>   SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https \
> +           file://CVE-2023-40660.patch \
>             "
>   DEPENDS = "virtual/libiconv openssl"
>