CVE-2018-20340

Description

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is currently in use. It is not possible to perform this attack with a genuine YubiKey.

Risk Information

Base Score

6.8

MODERATE

Vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.172

Associated Vulnerability

Vulnerability	OS Platform
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) u2f-host-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libu2f-host0-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libu2f-host-devel-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) u2f-host-debuginfo-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libu2f-host-debuginfo-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libu2f-host0-debuginfo-1.1.10-3.9.1.x86_64.rpm	Linux
SUSE-SU-2021:1755-1(SUSE Linux Enterprise Module for Basesystem 15-SP3 ) libu2f-host-debugsource-1.1.10-3.9.1.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234