Bug 1852006 (CVE-2020-15306)

Summary:	CVE-2020-15306 OpenEXR: Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jeischma, jridky, kwizart, manisandro, rdieter, rh-spice-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	OpenEXR 2.5.2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 17:14:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1852007, 1852008, 1853074, 1853075, 1910632
Bug Blocks:	1852018

Description Michael Kaplan 2020-06-29 15:22:30 UTC

An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.

References:

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md
https://github.com/AcademySoftwareFoundation/openexr/pull/738
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2

Comment 1 Michael Kaplan 2020-06-29 15:22:51 UTC

Created OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1852008]


Created mingw-OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1852007]

Comment 2 Todd Cullum 2020-07-01 20:58:41 UTC

The vulnerable getChunkOffsetTableSize() routine uses a parameter to decide when to ignore or not ignore the header's chunkCount; exposing the possibility that the chunkCount could be used even when it should have been ignored. The patch places the rules for when to ignore the chunkCount attribute directly into getChunkOffsetTableSize() so that the callers do not determine this.

Comment 3 Todd Cullum 2020-07-01 21:26:30 UTC

Statement:

This flaw does not affect versions of OpenEXR shipped with Red Hat Enterprise Linux 6 or 7 as the vulnerable code was introduced in subsequent versions of OpenEXR.

Comment 5 Todd Cullum 2020-07-02 21:30:27 UTC

To exploit this flaw, OpenEXR would need to be used in a service which parses untrusted input data, such as data received by a  web server, or in a social engineering attack where a user is tricked into opening a specially crafted file to be parsed by OpenEXR via some application which uses the library, e.g. GIMP.