CVE-2020-26572: 
NixOS vulnerability analysis and mitigation

CVE-2020-26572 affects the TCOS smart card software driver in OpenSC versions before 0.21.0-rc1. The vulnerability was discovered in October 2020 and involves a stack-based buffer overflow in the tcos_decipher function (NVD, CVE).

The vulnerability is classified as a stack-based buffer overflow vulnerability in the tcos_decipher function of OpenSC's TCOS smart card driver. It has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access is required and the primary impact is on system availability (NVD).

The vulnerability primarily affects system availability, with no direct impact on confidentiality or integrity. The CVSS scoring indicates that successful exploitation could lead to high availability impact on the affected system (NVD).

The vulnerability requires local access with low attack complexity and low privileges. No user interaction is needed for exploitation (NVD).

The vulnerability was fixed in OpenSC version 0.21.0-rc1 and later releases. Users are recommended to upgrade to the patched version. A fix was implemented through a commit that prevents out-of-bounds write in the affected function (GitHub Patch, OpenSC Release).

The vulnerability was acknowledged and addressed by various Linux distributions including Debian and Fedora, which released security updates to patch the vulnerability (Debian Advisory, Fedora Update).