Bug 1868532 (CVE-2020-17507)
| Summary: | CVE-2020-17507 qt: buffer over-read in read_xbm_body in gui/image/qxbmhandler.cpp | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | itamar, jgrulich, jreznik, kasal, kevin, me, rdieter, smparrish, than, tvainio |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | qt 5.15.1 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-10 14:21:30 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1868534, 1870297, 1870364, 1870365, 1918158 | ||
| Bug Blocks: | 1868533 | ||
|
Description
Dhananjay Arunesh
2020-08-13 02:40:59 UTC
Created qt tracking bugs for this issue: Affects: fedora-all [bug 1868534] Yes, Qt 4 appears to be vulnerable, we need to backport the fix. (Qt 3, on the other hand, does not contain the affected code (the XBM loader), so it cannot be vulnerable.) Flaw summary: In src/gui/image/qxbmhandler.cpp of Qt, there is a buffer overread in the read_xbm_body() function, which reads an X Bitmap Image body from an IO device. The function reads 300 bytes at a time from the input device into `buf` and then uses the pointer `p` to locate and parse hex data from within the buffer. Although the code checks for whether `p` is NULL, it does not check that `p` is inside of the bounds of `buf`. Since `p` is incremented in the loop, and the exit condition is based off of the height value of the XBM, it is possible for a buffer overread to occur due to a crafted height value where `p` is passed to hex2byte() or strstr(). The patch ensures on every iteration of the loop that `p` does not go out of bounds of `buf` and a check for whether the third and fourth chars are hex digits (i.e. 0x3A and not 0x*%) was also added. There is a hardcoded buflen of 300, and the patch's commit message notes that this leaves parsing of lines longer than this unreliable. FEDORA-2020-8dd86f1b3f has been pushed to the Fedora 31 stable repository. If problem still persists, please make note of it in this bug report. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:5021 https://access.redhat.com/errata/RHSA-2020:5021 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-17507 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1756 https://access.redhat.com/errata/RHSA-2021:1756 |