Bug 1311882 - (CVE-2014-9766) CVE-2014-9766 pixman: integer overflow in create_bits function
CVE-2014-9766 pixman: integer overflow in create_bits function
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20141014,repor...
: Reopened, Security
Depends On: 972647
Blocks: 1312311
  Show dependency treegraph
 
Reported: 2016-02-25 04:26 EST by Andrej Nemec
Modified: 2016-11-08 11:23 EST (History)
23 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-07-04 22:20:09 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andrej Nemec 2016-02-25 04:26:31 EST
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.

External references:

http://lists.freedesktop.org/archives/pixman/2014-April/003244.html

CVE assignment:

http://seclists.org/oss-sec/2016/q1/425
Comment 1 Doran Moppert 2016-06-09 20:56:36 EDT
Updated affects list for RHEL components.

Not affected because they already have the patch:
    rhel-6/pixman
    rhel-7/pixman
    rhel-7/qemu-guest-agent

Not affected because the guard is _pixman_multiply_overflows_int which
matches the type of each operand and thus the result of the multiplication:
    rhel-5/pixman
    rhel-5/qpixman
    rhel-7/qemu-qvm

Removed from whiteboard because these packages don't appear to exist in
current manifests:
    epel-7/mingw-pixman
    rhev-m-3/mingw-virt-viewer

Ping Kurt - not sure if I'm treating rhev-m correctly or looking in the
right places to audit.
Comment 5 Kurt Seifried 2016-06-10 12:09:09 EDT
What info is needed?
Comment 8 Doran Moppert 2016-07-04 22:17:38 EDT
Based on assertions from Mozilla that they believe their products only use the affected code in a safe context (with bounded width & height), and testing with firefox and thunderbird that has failed to disprove this assertion, I am marking Firefox, Thunderbird and Xulrunner as unaffected.

Testing has shown that the calls through Thebes only reach pixman with dimensions limited by display size.  Since exploitation requires a buffer of around at least 33MP, this can be considered safe.  Ditto for print to PDF/PS with any close to reasonable page size / DPI.

Note You need to log in before you can comment on or make changes to this bug.