An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.
The product reads data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://github.com/Yubico/yubihsm-shell | third party advisory |
| https://developers.yubico.com/yubihsm-shell/ | vendor advisory |
| https://www.yubico.com/support/security-advisories/ysa-2020-06/ | vendor advisory |
| https://blog.inhq.net/posts/yubico-libyubihsm-vuln/ | third party advisory exploit |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y77KQJW76M3PFOBFLBT6DLH2NWHYRNZO/ | vendor advisory |