CVE-2020-24387

CVE-2020-24387 is a denial-of-service vulnerability affecting yubihsm-shell versions up to 2.0.2, including those distributed with Fedora Project. The vulnerability stems from the yh_create_session() function's failure to validate the session ID returned by the device, leading to out-of-bounds read and write operations. With a CVSS score of 7.5 (HIGH), this vulnerability can be exploited remotely with low attack complexity, resulting in a denial of service. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.