Bug 1729034 (CVE-2019-13504)

Summary:	CVE-2019-13504 exiv2: out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jgrulich, michel, rdieter, rschiron
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in exiv2. An integer wraparound could lead to an out-of-bounds read in the way MemIo is implemented. Reading from the memory buffer with MemIo::Impl::read() reads data beyond the buffer’s limits. An attacker could abuse this flaw by providing a specially crafted image that when read, would cause the application to crash or to leak sensitive data.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-07-16 14:40:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1729035
Bug Blocks:	1728496

Description Dhananjay Arunesh 2019-07-11 08:56:41 UTC

A vulnerability was found in Exiv2, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp

Reference:
https://github.com/Exiv2/exiv2/pull/943

Comment 1 Dhananjay Arunesh 2019-07-11 08:56:52 UTC

Created exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1729035]

Comment 2 Riccardo Schirone 2019-07-16 11:57:45 UTC

Upstream patch:
https://github.com/Exiv2/exiv2/commit/bd0afe0390439b2c424d881c8c6eb0c5624e31d9 [master branch]
https://github.com/Exiv2/exiv2/commit/edb4bf78ca5820f2c7a852c8f2df11e6aba45704 [0.27-maintanance branch]

Comment 3 Riccardo Schirone 2019-07-16 13:27:44 UTC

Statement:

This issue did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 7, and 8 as variables MemIo::Impl::size_ and MemIo::Impl::idx_ are of type long, making it impossible to trigger the integer wraparound that would lead to an out-of-bound read.

Comment 4 Riccardo Schirone 2019-07-16 13:32:30 UTC

When seeking in MemIo (code in MemIo::Impl::seek) the new position is not properly checked, thus it is possible to move the current position beyond the limits of the memory buffer. If a read is done later (code in MemIo::Impl::read) the maximum number of bytes to read is computed by subtracting the current position value from the buffer's size value. When these two values are implemented as unsigned values (e.g. size_t), the computation may wraparound and more data than what really available would be reported, making it possible to read beyond the buffer's limits.

Comment 5 Product Security DevOps Team 2019-07-16 14:40:45 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-13504

Comment 6 Riccardo Schirone 2019-08-19 16:08:42 UTC

The flaw seems to be introduced in commit https://github.com/Exiv2/exiv2/commit/c72d16f4c402a8acc2dfe06fe3d58bf6cf99069e, where MemIo::Impl fields were changed from long to size_t.