{"action":"closed","issue":{"url":"https://api.github.com/repos/OpenSC/OpenSC/issues/434","labels_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/434/labels{/name}","comments_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/434/comments","events_url":"https://api.github.com/repos/OpenSC/OpenSC/issues/434/events","html_url":"https://github.com/OpenSC/OpenSC/issues/434","id":67429536,"number":434,"title":"minidriver: a security vulnerability at deauthentication ? (require a previous successful authentication)","user":{"login":"vletoux","id":10632326,"avatar_url":"https://avatars.githubusercontent.com/u/10632326?v=3","gravatar_id":"","url":"https://api.github.com/users/vletoux","html_url":"https://github.com/vletoux","followers_url":"https://api.github.com/users/vletoux/followers","following_url":"https://api.github.com/users/vletoux/following{/other_user}","gists_url":"https://api.github.com/users/vletoux/gists{/gist_id}","starred_url":"https://api.github.com/users/vletoux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vletoux/subscriptions","organizations_url":"https://api.github.com/users/vletoux/orgs","repos_url":"https://api.github.com/users/vletoux/repos","events_url":"https://api.github.com/users/vletoux/events{/privacy}","received_events_url":"https://api.github.com/users/vletoux/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-04-09T19:04:17Z","updated_at":"2015-04-14T20:49:30Z","closed_at":"2015-04-14T20:49:30Z","body":"Hi,\r\n\r\nI'd like a confirmation about the following findings before calling it a security vulnerability.\r\nCan you confirm it ?\r\n\r\n**The Problem:**\r\nCardDeauthenticateEx and CardDeauthenticate are implemented (and their pointers are returned from CardAcquireContect) but do not not disconnect the current user nor ask for a reset by returning an error code. There are returning both zero (success)\r\n\r\n**Explanation:**\r\nThe minidriver has an optimization for not resetting the card if an APDU can deauthenticate the current user. The APDU is transmitted by these functions.\r\nIf these functions are implemented, the Base CSP think that the current user has been deauthenticated and do not reset the card. Here, the function are implemented, the base csp do not reset the card and the card is still authenticated after an operation such a digital signature / deciphering.\r\n\r\nQuote from the minidriver specification:\r\n\"The CardDeauthenticate function is an optional export that should be provided if it is possible within the card minidriver to efficiently reverse the effect of authenticating a user or administrator without resetting the card. If this function is not implemented, the card minidriver should put NULL in the CARD_DATA structure pointer for this function.\r\n(...)\r\nIf the card minidriver returns a nonzero value from this function, the Base CSP/KSP resets the card.\"\r\n\r\n**Consequence:**\r\nA rogue application, after a successful authentication of the card (for example after a digital signature), can send an APDU to force a signature / decryption or PIN change.\r\nThis problem cannot be exploited by another application running the minidriver (because the state, as seen by the new application, is unauthenticated). The APDU must be send \"manually\".\r\nThe possibility to exploit it after a smart card login is unknown, but most probably not possible (because since Vista, authentication is made using a separate context).\r\n\r\n**Risk estimated:** low\r\nIt requires the installation of the minidriver (not by default), a configuration of the minidriver (writing an inf file / modify the registry to make it work - a volontary action from the user), a successful authentication and an exploit program run by the user. The exploit program needs to know how to perform the low level operations on the card.\r\n\r\n**How to reproduce**\r\nA) Write an application calling the minidriver to perform a signature (using CryptSignHash).\r\nOnce the PIN has been asked and the security operation perform, do not remove the card and send an APDU which needs an authentication and observe the result.\r\n\r\nB) run a monitoring tool (such as rohitab API monitor) to check for SCardEndTransaction, SCardDisconnect and check the dwDisposition parameter as called by the BaseCSP is set to 0 (SCARD_LEAVE_CARD).\r\n\r\n![monitoring](https://cloud.githubusercontent.com/assets/10632326/7074445/d0ffda08-defa-11e4-9d69-c4dd99eab469.png)\r\n\r\n\r\nregards,\r\nVincent\r\n"}}