CVE-2024-45620: 
NixOS vulnerability analysis and mitigation

A vulnerability (CVE-2024-45620) was discovered in the pkcs15-init tool in OpenSC. The vulnerability was reported on September 3, 2024, affecting OpenSC versions up to (excluding) 0.26.0. This security issue impacts various systems including Red Hat Enterprise Linux 7.0, 8.0, and 9.0 distributions (NVD CVE, Debian Tracker).

The vulnerability is classified as a classic buffer overflow (CWE-120) where buffers are partially filled with data, and initialized parts of the buffer can be incorrectly accessed. The CVSS v3.1 base score is 3.9 (LOW) with the vector string CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating physical access is required with high attack complexity (NVD CVE).

The vulnerability can lead to unauthorized access of initialized parts of buffers when they are partially filled with data. The impact is considered low, affecting confidentiality, integrity, and availability, as indicated by the CVSS metrics (Red Hat Bugzilla).

Fixed versions have been released for various distributions: Debian Bullseye (0.21.0-1+deb11u1), Bookworm (0.23.0-0.3+deb12u2), and Sid/Trixie (0.26.0-1). Users are advised to upgrade to these patched versions (Debian Tracker).