Bug 1644258 (CVE-2018-4022)

Summary: CVE-2018-4022 mkvtoolnix: MKVINFO read_one_element code execution vulnerability
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: dmitry, dominik, itamar, kwizart, martin.sourada
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mkvtoolnix-28.2.0-1.el7,mkvtoolnix-28.2.0-1.fc28,mkvtoolnix-28.2.0-1.fc29,mkvtoolnix-28.2.0-1.fc27 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-12-25 23:20:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1644259, 1644260    
Bug Blocks:    

Description Andrej Nemec 2018-10-30 10:26:26 UTC
A use-after-free vulnerability exists in the way MKVToolNix MKVINFO v25.0.0 handles the MKV (matroska) file format. A specially crafted MKV file can cause arbitrary code execution in the context of the current user.

External References:

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0694

Comment 1 Andrej Nemec 2018-10-30 10:27:11 UTC
Created mkvtoolnix tracking bugs for this issue:

Affects: epel-all [bug 1644260]
Affects: fedora-all [bug 1644259]

Comment 2 Dominik 'Rathann' Mierzejewski 2018-10-30 10:30:36 UTC
What's the point of this bug? We have 27.0.0 in Fedora and EPEL7 already.

Comment 3 Dominik 'Rathann' Mierzejewski 2018-10-30 10:32:51 UTC
Ah, your description is misleading. It looks like versions up to 28.1.0 are affected:

https://mkvtoolnix.download/doc/NEWS.md

# Version 28.2.0 "The Awakening" 2018-10-25

## Bug fixes

* mkvmerge, mkvinfo, mkvextract, mkvpropedit, MKVToolNix GUI's info tool &
  chapter editor: fixed a case of memory being accessed after it had been
  freed earlier. This can be triggered by specially crafted Matroska files and
  lead to arbitrary code execution. The vulnerability was reported as Cisco
  TALOS 2018-0694 on 2018-10-25.