Heap overflow

2023-12-1512:15:00

PRIOn knowledge base

www.prio-n.com

heap overflow

desfire keys

boundary checking

buffer overflow

remote code execution

default desfire key

nvd

8 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

49.0%

JSON

When reading DesFire keys, the function that reads the card isn’t properly checking the boundaries when copying
internally the data received. This allows a heap based buffer overflow that could lead to a potential Remote Code
Execution on the targeted device. This is especially problematic if you use Default DESFire key.

CPENameOperatorVersion
morphowave_compact_firmwarelt2.12.2
morphowave_sp_firmwarelt1.2.7
morphowave_xp_firmwarelt2.12.2
sigma_extreme_firmwarelt4.15.5
sigma_lite\\+_firmwarelt4.15.5
sigma_lite_firmwarelt4.15.5
sigma_wide_firmwarelt4.15.5
visionpass_firmwarelt2.12.2

Name	Operator	Version
morphowave_compact_firmware	lt	2.12.2
morphowave_sp_firmware	lt	1.2.7
morphowave_xp_firmware	lt	2.12.2
sigma_extreme_firmware	lt	4.15.5
sigma_lite\\+_firmware	lt	4.15.5
sigma_lite_firmware	lt	4.15.5
sigma_wide_firmware	lt	4.15.5
visionpass_firmware	lt	2.12.2

References

www.idemia.com/wp-content/uploads/2023/11/Security-Advisory-SA-2023-05-2.pdf