Bug 1216020 (CVE-2015-3418)

Summary:	CVE-2015-3418 xorg-x11-server: divide-by-zero when checking image dimensions
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ajax, huzaifas, security-response-team, xgl-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker could potentially crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 00:45:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1170917, 1216022, 1217471
Bug Blocks:	1216021

Description Martin Prpič 2015-04-28 11:41:05 UTC

A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker may be able to crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file.

This was introduced by the fix for the CVE-2014-8092 issue.

Upstream patch:

http://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b

Comment 1 Martin Prpič 2015-04-28 11:42:36 UTC

Created xorg-x11-server tracking bugs for this issue:

Affects: fedora-all [bug 1216022]

Comment 2 Stefan Cornelius 2015-04-30 08:02:29 UTC

Although a malicious authenticated client could exploit this flaw to crash the X.Org server, this does not really cross any security boundaries, as X.Org provides other, intended mechanisms with the same effect. Additionally, the impact of this flaw is limited to a crash only; it should not be possible to gain elevated privileges by exploiting this problem.

However, it might be possible for a legitimate application to open an attacker-provided image with height 0, which is then passed all the way down to the vulnerable X.Org function, where height 0 may trigger the divide-by-zero, ultimately crashing the X.Org server.

I've tried to crash my X.Org server, but so far I could not find a suitable vector.

Comment 3 Stefan Cornelius 2015-04-30 08:09:51 UTC

Statement:

This issue affects the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue for Red Hat Enterprise Linux 7.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.

Comment 5 Huzaifa S. Sidhpurwala 2015-07-27 04:44:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHBA-2015-1445 https://rhn.redhat.com/errata/RHBA-2015-1445.html