Bug 1494781
| Summary: | It is a heap-buffer-overflow in Exiv2::s2Data (types.cpp:383) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Liu Zhu <fantasy7082> | ||||
| Component: | exiv2 | Assignee: | Jan Grulich <jgrulich> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.5-Alt | CC: | ago, carnil, dan.cermak, raphael | ||||
| Target Milestone: | rc | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 12:46:58 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
./exiv2 -V exiv2 0.26 001a00 (64 bit build) Copyright (C) 2004-2017 Andreas Huggel. This was assigned CVE-2017-14866. Can you please report the issue upstream? Is there a reason why you are fuzzing the trunk/version of exiv2 and you are reporting it to redhat instead of the upstream project? Reported to upstream here: https://github.com/Exiv2/exiv2/issues/140 Fixed with exiv2-0.27.0-1.el7_6. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:2101 |
Created attachment 1329795 [details] PoC File ./exiv2 006-heap-buffer-over Error: Offset of directory Image, entry 0x00fe is out of bounds: Offset = 0x00000000; truncating the entry Error: Offset of directory Image, entry 0x011b is out of bounds: Offset = 0x0080004a; truncating the entry Error: Offset of directory Image, entry 0x02bc is out of bounds: Offset = 0x30000184; truncating the entry Error: Upper boundary of data for directory Image, entry 0x83bb is out of bounds: Offset = 0x00003d7c, size = 26476552, exceeds buffer size by 26182327 Bytes; truncating the entry Error: Directory Photo with 12336 entries considered invalid; not read. ================================================================= ==47847==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62100001661c at pc 0x7f3014bec6ff bp 0x7ffdc80d2f60 sp 0x7ffdc80d2f50 WRITE of size 1 at 0x62100001661c thread T0 #0 0x7f3014bec6fe in Exiv2::s2Data(unsigned char*, short, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/types.cpp:383 #1 0x7f3014ac2831 in long Exiv2::toData<short>(unsigned char*, short, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/include/exiv2/value.hpp:1477 #2 0x7f3014acbeeb in Exiv2::ValueType<short>::copy(unsigned char*, Exiv2::ByteOrder) const /root/fuzzing/exiv2-trunk/include/exiv2/value.hpp:1612 #3 0x7f3014abcaa4 in Exiv2::Exifdatum::copy(unsigned char*, Exiv2::ByteOrder) const /root/fuzzing/exiv2-trunk/src/exif.cpp:362 #4 0x7f3014bc1eff in Exiv2::TiffImage::readMetadata() /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:204 #5 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289 #6 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244 #7 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170 #8 0x7f3013e3b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #9 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8) 0x62100001661c is located 0 bytes to the right of 4380-byte region [0x621000015500,0x62100001661c) allocated by thread T0 here: #0 0x7f30152686b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2) #1 0x7f3014bea695 in Exiv2::DataBuf::alloc(long) /root/fuzzing/exiv2-trunk/src/types.cpp:158 #2 0x7f3014bc1e62 in Exiv2::TiffImage::readMetadata() /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:203 #3 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289 #4 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244 #5 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170 #6 0x7f3013e3b82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) SUMMARY: AddressSanitizer: heap-buffer-overflow /root/fuzzing/exiv2-trunk/src/types.cpp:383 Exiv2::s2Data(unsigned char*, short, Exiv2::ByteOrder) Shadow bytes around the buggy address: 0x0c427fffac70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffac80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffac90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffaca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffacb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c427fffacc0: 00 00 00[04]fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffacd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427ffface0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffacf0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffad00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffad10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==47847==ABORTING