Bug 1470913 - There is an infinite loop in Exiv2::Image::printIFDStructure funtion of image.cpp in exiv2. A crafted input will lead to remote denial of service attack.
There is an infinite loop in Exiv2::Image::printIFDStructure funtion of imag...
Status: NEW
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: exiv2 (Show other bugs)
7.5-Alt
x86_64 Linux
unspecified Severity urgent
: rc
: ---
Assigned To: Jan Grulich
Desktop QE
: Security
Depends On:
Blocks: CVE-2017-11338
  Show dependency treegraph
 
Reported: 2017-07-13 21:52 EDT by owl337
Modified: 2017-10-19 17:01 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Triggered by "./exiv2 $POC" (102 bytes, application/x-rar)
2017-07-13 21:52 EDT, owl337
no flags Details

  None (edit)
Description owl337 2017-07-13 21:52:13 EDT
Created attachment 1298062 [details]
Triggered by  "./exiv2 $POC"

Description of problem:

There is an infinite loop in  Exiv2::Image::printIFDStructure funtion of image.cpp in  exiv2. A crafted input will lead to remote denial of service attack.

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./exiv2 POC4

Steps to Reproduce:

The output information is as follows:

$./exiv2 POC4
RW2 IMAGE

GDB debugging information is as follows:
(gdb) set args POC4
(gdb) r
 ...
(gdb) bt
#0  Exiv2::Image::printIFDStructure (this=<optimized out>, io=..., out=..., option=Exiv2::kpsRecursive, start=0, 
    bSwap=<optimized out>, c=<optimized out>, depth=0) at image.cpp:492
#1  0x00007ffff70b90e1 in Exiv2::Image::printTiffStructure (this=0x611000009dc0, io=..., out=..., 
    option=Exiv2::kpsRecursive, depth=-1, offset=<optimized out>) at image.cpp:518
#2  0x00007ffff724924c in Exiv2::Rw2Image::printStructure (this=<optimized out>, out=..., option=<optimized out>, 
    depth=<optimized out>) at rw2image.cpp:115
#3  0x00007ffff724a1dc in Exiv2::Rw2Image::readMetadata (this=<optimized out>) at rw2image.cpp:134
#4  0x0000000000518d8c in Action::Print::printSummary (this=<optimized out>) at actions.cpp:289
#5  0x0000000000518489 in Action::Print::run (this=0x60400000da50, path=...) at actions.cpp:244
#6  0x00000000004e2ebc in main (argc=<optimized out>, argv=<optimized out>) at exiv2.cpp:170


This vulnerability was triggered in Exiv2::Image::printIFDStructure () at image.cpp:492,which will result in a infinite loop.

 348         do {
 349             // Read top of directory
 350             io.seek(start,BasicIo::beg);
 351             io.read(dir.pData_, 2);
 352             uint16_t   dirLength = byteSwap2(dir,0,bSwap);
 353 
 354             bool tooBig = dirLength > 500;
 355             if ( tooBig ) throw Error(55);
 356 
 357             if ( bFirst && bPrint ) {
 359                 if ( tooBig ) out << Internal::indent(depth) << "dirLength = " << dirLength << std::endl;
 360             }
 361 
 ...
 491             if ( start ) {
 492                 io.read(dir.pData_, 4);
 493                 start = tooBig ? 0 : byteSwap4(dir,0,bSwap);
 494             }
 495         } while (start) ;


Actual results:

denial of service

Expected results:

denial of service

Additional info:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability.
Comment 2 Adam Mariš 2017-07-24 08:41:59 EDT
Please, report this issue to upstream. Thanks!
Comment 3 Raphaël Hertzog 2017-08-31 10:20:59 EDT
I forwarded this report to upstream: https://github.com/Exiv2/exiv2/issues/51
Comment 4 dan.cermak 2017-10-19 17:01:48 EDT
This has been fixed upstream (on master, backported to 0.26, backporting to 0.25 is in progress).

Note You need to log in before you can comment on or make changes to this bug.