Bug 1915432 (CVE-2020-35655)

Summary:	CVE-2020-35655 python-pillow: Buffer over-read in SGI RLE image reader
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bdettelb, cstratak, manisandro, miminar, python-maint, tomckay, torsava
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-pillow 8.1.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in python-pillow. SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 18:24:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1915434, 1915435, 1915436, 1916023
Bug Blocks:	1915433

Description Michael Kaplan 2021-01-12 16:09:55 UTC

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

External References: 

https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security

Comment 1 Michael Kaplan 2021-01-12 16:12:08 UTC

Created python-pillow tracking bugs for this issue:

Affects: fedora-32 [bug 1915435]
Affects: fedora-33 [bug 1915434]

Comment 3 Todd Cullum 2021-01-13 23:53:06 UTC

Upstream commit: https://github.com/python-pillow/Pillow/commit/120eea2e4547a7d1826afdf01563035844f0b7d5

Comment 5 Todd Cullum 2021-01-14 00:20:34 UTC

Flaw summary:

In `ImagingSgiRleDecode()` of `src/libImaging/SgiRleDecode.c`, it's possible for a call to `malloc()` to request 4 bytes less than necessary, which can lead to a heap buffer overflow -> out-of-bounds read subsequently. The upstream patch moves length checks above the call to `malloc()` and exits `ImagingSgiRleDecode()` with an error code to avoid passing an improper length to `malloc()`.

An attacker who is able to submit a crafted SGI RLE file to an application using python-pillow to decode it, could trigger an out-of-bounds read.

Comment 6 Mark Cooper 2021-01-29 02:07:07 UTC

The following Quay containers contain python-pillow 7.2.0 and hence are affected by the CVE (checked upstream 7.2.0 contains the same vulnerable code):
 - quay-registry-container
 - quay-builder-qemu-rhcos-container

Comment 9 errata-xmlrpc 2021-11-09 17:24:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4149 https://access.redhat.com/errata/RHSA-2021:4149