Red Hat Bugzilla – Bug 1434459
CVE-2017-6852 jasper: Out of bounds heap read in jpc_dec_decodepkt
Last modified: 2018-07-18 11:17:58 EDT
Out-of-bounds heap read vulnerability was found in jpc_dec_decodepkt. Upstream bug: https://github.com/mdadams/jasper/issues/114 Reference: http://seclists.org/oss-sec/2017/q1/193
Created jasper tracking bugs for this issue: Affects: epel-5 [bug 1434466] Affects: fedora-all [bug 1434464] Created mingw-jasper tracking bugs for this issue: Affects: epel-7 [bug 1434465] Affects: fedora-all [bug 1434467]
Original reporter's advisory: https://blogs.gentoo.org/ago/2017/01/25/jasper-heap-based-buffer-overflow-in-jpc_dec_decodepkt-jpc_t2dec-c/ Relevant information from the advisory: Another round of fuzzing shows that a crafted image causes a read overflow. The complete ASan output: # imginfo -f $FILE warning: ignoring unknown marker segment (0xff70) type = 0xff70 (UNKNOWN); len = 35;00 01 43 72 65 61 74 6f 74 3a 30 4a 61 73 50 65 72 00 01 00 00 73 69 6f 6e 20 31 2e 39 30 30 2e 39 warning: trailing garbage in marker segment (3 bytes) warning: trailing garbage in marker segment (8 bytes) warning: trailing garbage in marker segment (6 bytes) ================================================================= ==30315==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a00001f808 at pc 0x7fb7b2667e54 bp 0x7ffd0a9ab890 sp 0x7ffd0a9ab888 READ of size 8 at 0x61a00001f808 thread T0 #0 0x7fb7b2667e53 in jpc_dec_decodepkt /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14 #1 0x7fb7b2667e53 in jpc_dec_decodepkts /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:454 #2 0x7fb7b25ccd37 in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:628:6 #3 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10 #4 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262 #5 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21 #6 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16 #7 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16 #8 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #9 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8) 0x61a00001f808 is located 48 bytes to the right of 1368-byte region [0x61a00001f280,0x61a00001f7d8) allocated by thread T0 here: #0 0x4d2a98 in malloc /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64 #1 0x7fb7b2575160 in jas_malloc /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:242:11 #2 0x7fb7b2575160 in jas_alloc2 /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:275 #3 0x7fb7b25ca2bf in jpc_dec_tileinit /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:841:24 #4 0x7fb7b25ca2bf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:594 #5 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10 #6 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262 #7 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21 #8 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16 #9 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16 #10 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14 in jpc_dec_decodepkt Shadow bytes around the buggy address: 0x0c347fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c347fffbef0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa =>0x0c347fffbf00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c347fffbf50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==30315==ABORTING Affected version: 2.0.10 Fixed version: N/A Commit fix: N/A Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: CVE-2017-6852 Reproducer: https://github.com/asarubbo/poc/blob/master/00126-jasper-heapoverflow-jpc_dec_decodepkt
The issue was reported as out-of-bounds read, however, I only see this assertion in all versions tested, including 2.0.10 mentioned in the advisory: src/libjasper/jpc/jpc_t2cod.c:305: jpc_pi_nextrpcl: Assertion `pi->prcno < pi->pirlvl->numprcs' failed. Upstream also notes they're only able to see the assertion failure and not the claimed OOB read.