Bug 1277897 (CVE-2015-7805)
| Summary: | CVE-2015-7805 libsndfile: Heap overflow vulnerability when parsing specially crafted AIFF header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | andreas, brendan.jones.it, carnil, dkholia, dominik, dtimms, fdc, gemi, lkundrak, lpoetter, mhlavink, moez.roy, oget.fedora, rdieter, scorneli, slawomir, wtaymans |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-11-27 12:03:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1277899, 1277900, 1277901, 1277902, 1277903, 1277904, 1277905, 1277906 | ||
| Bug Blocks: | 1277910 | ||
|
Description
Adam Mariš
2015-11-04 10:23:11 UTC
Created audacity tracking bugs for this issue: Affects: fedora-all [bug 1277902] Affects: epel-all [bug 1277904] Created jack-audio-connection-kit tracking bugs for this issue: Affects: fedora-all [bug 1277901] Affects: epel-all [bug 1277903] Created libsndfile tracking bugs for this issue: Affects: epel-5 [bug 1277905] Created pulseaudio tracking bugs for this issue: Affects: epel-5 [bug 1277906] The problem appears to be in the header_read() function in src/common.c
>> if (psf->headindex + bytes > SIGNED_SIZEOF (psf->header))
>> 806 { int most ;
>> 807
>> 808 most = SIGNED_SIZEOF (psf->header) - psf->headindex ;
>> 809 psf_fread (psf->header + psf->headend, 1, most, psf) ;
>> 810 memset ((char *) ptr + most, 0, bytes - most) ;
>> 811
>> 812 psf_fseek (psf, bytes - most, SEEK_CUR) ;
>> 813 return bytes ;
>> 814 } ;
line 808 is trying to calculate the maximum remaining space in the header, "most". However, this calculation does not take "psf->headend" into account.
in line 809, psf_fread() tries to append "most" bytes to the header, but the start is offset by "psf->headend". Since "psf->headend" was not part of the "most" calculation, we end up overflowing psf->header.
After the psf->header, there are a couple function pointers for special IO functions. It's possible to e.g. overwrite the "seek" function pointer, which causes the psf_fseek() in line 812 to ultimately jump to a location controlled by the attacker.
libsndfile-1.0.25-17.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. libsndfile-1.0.17-7.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report. libsndfile-1.0.25-17.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. libsndfile-1.0.25-16.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |