In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
{ "vanir_signatures": [ { "id": "CVE-2019-9578-240562e0", "signature_type": "Line", "target": { "file": "u2f-host/devs.c" }, "digest": { "line_hashes": [ "11567275744523841877518153416187518118", "44370850034924077708171989660832381896", "188303028343851327688763961351998290166", "145078100563149133988154089729284353283", "216224806556506021471973488479284945323", "78543609262864008034404409691289906146", "298195757489697171354479924323044485927", "314185290226119270872259819350989570243", "24939522874790354133884502489879271461", "76490889385848227444144861291301719677", "314261858854284419405726470030233727425", "148922957106482978517489830381474987071", "314370417866445732464821320395808641267", "14486720878436553949349358003086576635" ], "threshold": 0.9 }, "source": "https://github.com/yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5", "signature_version": "v1", "deprecated": false }, { "id": "CVE-2019-9578-c6e7e14f", "signature_type": "Function", "target": { "file": "u2f-host/devs.c", "function": "init_device" }, "digest": { "function_hash": "147196423138426783156581629780352000219", "length": 712.0 }, "source": "https://github.com/yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5", "signature_version": "v1", "deprecated": false } ] }