Bug 1593554 (CVE-2018-1152)

Summary:	CVE-2018-1152 libjpeg-turbo: Divide by zero allows for denial of service via crafted BMP image
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	erik-fedora, klember, negativo17, nforro, phracek, rjones, vonsch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:29:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1593555, 1593556, 1593557, 1593558
Bug Blocks:	1593560

Description Sam Fowler 2018-06-21 05:13:28 UTC

libjpeg-turbo through version 1.5.90 is vulnerable to a divide by zero flaw in the rdbmp.c:start_input_bmp() function. An attacker could exploit this to cause a denial of service via crafted BMP image.


External Reference:

https://www.tenable.com/security/research/tra-2018-17


Upstream patch:

https://github.com/libjpeg-turbo/libjpeg-turbo/commit/43e84cff1bb2bd8293066f6ac4eb0df61ddddbc6

Comment 1 Sam Fowler 2018-06-21 05:14:17 UTC

Created libjpeg-turbo tracking bugs for this issue:

Affects: fedora-all [bug 1593555]


Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-all [bug 1593556]

Comment 3 Sam Fowler 2018-06-21 05:15:34 UTC

Created mingw-libjpeg-turbo tracking bugs for this issue:

Affects: epel-7 [bug 1593558]

Comment 5 Stefan Cornelius 2018-07-05 19:13:30 UTC

The floating point exception actually happens in the "alloc_sarray()" function, although the patch adds checks to "start_input_bmp()" function. The cjpeg binaries we ship in RHEL7 refuse to load the specially crafted BMP file. It seems like the only obvious vector is via the "tjLoadImage()" function, which was added to 2.x versions and is not yet available in versions we ship in RHEL6/7.

Comment 6 Stefan Cornelius 2018-07-05 19:13:41 UTC

Statement:

This issue did not affect the versions of libjpeg-turbo as shipped with Red Hat Enterprise Linux 6 and 7.