Bug 1939161 (CVE-2021-20302)

Summary:	CVE-2021-20302 OpenEXR: Floating-point-exception in Imf_2_5::precalculateTileInfot
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jeischma, jridky, kwizart, rdieter, rh-spice-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	OpenEXR 2.5.4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 23:22:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1939177, 1944925, 1944926, 1944927
Bug Blocks:	1929339, 2002258

Description Michael Kaplan 2021-03-15 17:27:58 UTC

Floating-point-exception in Imf_2_5::precalculateTileInfot

Comment 1 Michael Kaplan 2021-03-15 17:28:02 UTC

External References:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25894

Comment 2 Michael Kaplan 2021-03-15 17:48:25 UTC

Created OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1939177]

Comment 3 Todd Cullum 2021-03-30 23:44:39 UTC

Upstream PR (has explanation of changes): https://github.com/AcademySoftwareFoundation/openexr/pull/842

Flaw summary:

If a crafted single-part non-image file is processed by OpenEXR, it is not detected and could lead to a floating point exception in methods such as precalculateTileInfot().

Comment 6 Todd Cullum 2021-03-31 00:02:24 UTC

*** Bug 1939162 has been marked as a duplicate of this bug. ***