Bug 1992202 (CVE-2021-34334)

Summary: CVE-2021-34334 exiv2: DoS due to integer overflow in loop counter
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jgrulich, manisandro, michel, rdieter
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1992203, 1992204, 1996166, 1996167, 1996168    
Bug Blocks: 1992216    

Description Guilherme de Almeida Suckevicz 2021-08-10 18:01:27 UTC
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop is triggered when Exiv2 is used to read the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.5.


Upstream patch:

Comment 1 Guilherme de Almeida Suckevicz 2021-08-10 18:01:47 UTC
Created exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1992204]

Created mingw-exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1992203]

Comment 2 Garrett Tucker 2021-08-20 12:55:56 UTC
The attack vector for this CVE is local, not network based. Exiv2 would require manual execution with specific flags, and requires user interaction on a crafted file to be able to exploit this flaw and is not bound to the network. This CVE is a very similar CVE to CVE-2021-37616 which is correctly labeled as AV:L not AV:N.