Bug 1494782
| Summary: | It is a heap-buffer-overflow in Exiv2::l2Data (types.cpp:398) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Liu Zhu <fantasy7082> | ||||
| Component: | exiv2 | Assignee: | Jan Grulich <jgrulich> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Desktop QE <desktop-qa-list> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.5-Alt | CC: | carnil, dan.cermak, raphael | ||||
| Target Milestone: | rc | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 12:47:14 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
./exiv2 -V exiv2 0.26 001a00 (64 bit build) Copyright (C) 2004-2017 Andreas Huggel. This was assigned CVE-2017-14858. Can you please report this upstream. Is there a reason why you are fuzzing the trunk/version of exiv2 and you are reporting it to redhat instead of the upstream project? Forwarded to upstream here: https://github.com/Exiv2/exiv2/issues/138 Fixed with exiv2-0.27.0-1.el7_6. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:2101 |
Created attachment 1329796 [details] PoC File # ./exiv2 007-heap-buffer-over Error: Offset of directory Image, entry 0x0100 is out of bounds: Offset = 0x30303030; truncating the entry Warning: Directory Image, entry 0x0111: Strip 17 is outside of the data area; ignored. Error: Directory Photo with 8224 entries considered invalid; not read. Warning: Removing 913 characters from the beginning of the XMP packet Error: XMP Toolkit error 201: XML parsing failure Warning: Failed to decode XMP metadata. ================================================================= ==49706==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62700000d930 at pc 0x7f0bec1a48d2 bp 0x7ffc2177dc50 sp 0x7ffc2177dc40 WRITE of size 1 at 0x62700000d930 thread T0 #0 0x7f0bec1a48d1 in Exiv2::l2Data(unsigned char*, int, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/src/types.cpp:398 #1 0x7f0bec07a859 in long Exiv2::toData<int>(unsigned char*, int, Exiv2::ByteOrder) /root/fuzzing/exiv2-trunk/include/exiv2/value.hpp:1486 #2 0x7f0bec083157 in Exiv2::ValueType<int>::copy(unsigned char*, Exiv2::ByteOrder) const /root/fuzzing/exiv2-trunk/include/exiv2/value.hpp:1612 #3 0x7f0bec074aa4 in Exiv2::Exifdatum::copy(unsigned char*, Exiv2::ByteOrder) const /root/fuzzing/exiv2-trunk/src/exif.cpp:362 #4 0x7f0bec179eff in Exiv2::TiffImage::readMetadata() /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:204 #5 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289 #6 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244 #7 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170 #8 0x7f0beb3f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) #9 0x421af8 in _start (/usr/local/exiv2_ASAN/bin/exiv2+0x421af8) 0x62700000d930 is located 0 bytes to the right of 12336-byte region [0x62700000a900,0x62700000d930) allocated by thread T0 here: #0 0x7f0bec8206b2 in operator new[](unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x996b2) #1 0x7f0bec1a2695 in Exiv2::DataBuf::alloc(long) /root/fuzzing/exiv2-trunk/src/types.cpp:158 #2 0x7f0bec179e62 in Exiv2::TiffImage::readMetadata() /root/fuzzing/exiv2-trunk/src/tiffimage.cpp:203 #3 0x43ab02 in Action::Print::printSummary() /root/fuzzing/exiv2-trunk/src/actions.cpp:289 #4 0x43a1af in Action::Print::run(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /root/fuzzing/exiv2-trunk/src/actions.cpp:244 #5 0x422129 in main /root/fuzzing/exiv2-trunk/src/exiv2.cpp:170 #6 0x7f0beb3f382f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f) SUMMARY: AddressSanitizer: heap-buffer-overflow /root/fuzzing/exiv2-trunk/src/types.cpp:398 Exiv2::l2Data(unsigned char*, int, Exiv2::ByteOrder) Shadow bytes around the buggy address: 0x0c4e7fff9ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff9ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff9af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff9b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c4e7fff9b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c4e7fff9b20: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa 0x0c4e7fff9b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff9b40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff9b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff9b60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4e7fff9b70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe ==49706==ABORTING