Bug 1891984 (CVE-2020-27750)

Summary: CVE-2020-27750 ImageMagick: division by zero in MagickCore/colorspace-private.h
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fedora, jhorak, mike, pahan, rhel8-maint, security-response-team, stransky
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: ImageMagick 7.0.8-68 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior in the form of values outside the range of types `unsigned char` and math division by zero. The highest threat from this vulnerability is to system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-11-24 23:34:17 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1901241, 1901242, 1910557    
Bug Blocks: 1891602    

Description Guilherme de Almeida Suckevicz 2020-10-27 19:46:48 UTC
In ImageMagick 7.0.8-67 there are 3 division by zero at MagickCore/colorspace-private.h and outside the range bug at MagickCore/quantum.h:120.


Upstream patch:

Comment 1 Todd Cullum 2020-10-28 23:18:31 UTC
Flaw Summary:

In ConvertRGBToCMYK() of MagickCore/colorspace-private.h , there are calculations involved in cyan, magenta, and yellow colors which could cause a divide-by-zero runtime error and crash ImageMagick when it is provided with untrusted input file data. The patch uses the function PerceptibleReciprocal() in addition to replacing division with multiplication, in order to avoid divide-by-zero conditions.

I'm not certain that the patch there fixes the out-of-range bug but that may have been patched elsewhere.

Comment 2 Todd Cullum 2020-10-28 23:21:27 UTC

Name: Suhwan Song (Seoul National University)

Comment 3 Todd Cullum 2020-10-29 19:18:42 UTC

This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Comment 4 Guilherme de Almeida Suckevicz 2020-11-24 19:08:36 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 1901241]
Affects: fedora-all [bug 1901242]

Comment 5 Product Security DevOps Team 2020-11-24 23:34:17 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):