Bug 1891984 (CVE-2020-27750)

Summary:	CVE-2020-27750 ImageMagick: division by zero in MagickCore/colorspace-private.h
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora, jhorak, mike, pahan, rhel8-maint, security-response-team, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ImageMagick 7.0.8-68	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior in the form of values outside the range of types `unsigned char` and math division by zero. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-24 23:34:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1901241, 1901242, 1910557
Bug Blocks:	1891602

Description Guilherme de Almeida Suckevicz 2020-10-27 19:46:48 UTC

In ImageMagick 7.0.8-67 there are 3 division by zero at MagickCore/colorspace-private.h and outside the range bug at MagickCore/quantum.h:120.

Reference:
https://github.com/ImageMagick/ImageMagick/issues/1711

Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/a81ca9a1b46a96be83682af3389f0a6f3d0d389d

Comment 1 Todd Cullum 2020-10-28 23:18:31 UTC

Flaw Summary:

In ConvertRGBToCMYK() of MagickCore/colorspace-private.h , there are calculations involved in cyan, magenta, and yellow colors which could cause a divide-by-zero runtime error and crash ImageMagick when it is provided with untrusted input file data. The patch uses the function PerceptibleReciprocal() in addition to replacing division with multiplication, in order to avoid divide-by-zero conditions.

I'm not certain that the patch there fixes the out-of-range bug but that may have been patched elsewhere.

Comment 2 Todd Cullum 2020-10-28 23:21:27 UTC

Acknowledgments:

Name: Suhwan Song (Seoul National University)

Comment 3 Todd Cullum 2020-10-29 19:18:42 UTC

Statement:

This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regarding support scopes, please see https://access.redhat.com/support/policy/updates/errata .

Comment 4 Guilherme de Almeida Suckevicz 2020-11-24 19:08:36 UTC

Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 1901241]
Affects: fedora-all [bug 1901242]

Comment 5 Product Security DevOps Team 2020-11-24 23:34:17 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27750