CVE-2020-24388

HIGH

yubihsm-shell < 2.0.2 - Denial of Service via Unvalidated Message Length Field

Title source: llm

Description

An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a message received from the device. This could lead to an oversized memcpy() call that will crash the running process. This could be used by an attacker to cause a denial of service.

References (5)

Core 5

Core References

Vendor Advisory x_refsource_misc

https://developers.yubico.com/yubihsm-shell/

Vendor Advisory x_refsource_misc

https://www.yubico.com/support/security-advisories/ysa-2020-06/

Exploit, Third Party Advisory x_refsource_misc

https://blog.inhq.net/posts/yubico-libyubihsm-vuln/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y77KQJW76M3PFOBFLBT6DLH2NWHYRNZO/

Third Party Advisory x_refsource_misc

https://github.com/Yubico/yubihsm-shell

View Writeup ZIP pw:eip

Scores

CVSS v3 7.5

EPSS 0.0173

EPSS Percentile 74.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20 CWE-787

Status published

Products (2)

fedoraproject/fedora 33

yubico/yubihsm-shell < 2.0.2

Published Oct 19, 2020

Tracked Since Feb 18, 2026