Bug 1729034 (CVE-2019-13504) - CVE-2019-13504 exiv2: out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp
Summary: CVE-2019-13504 exiv2: out-of-bounds read in Exiv2::MrwImage::readMetadata in ...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2019-13504
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1729035
Blocks: 1728496
TreeView+ depends on / blocked
 
Reported: 2019-07-11 08:56 UTC by Dhananjay Arunesh
Modified: 2021-02-16 21:43 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in exiv2. An integer wraparound could lead to an out-of-bounds read in the way MemIo is implemented. Reading from the memory buffer with MemIo::Impl::read() reads data beyond the buffer’s limits. An attacker could abuse this flaw by providing a specially crafted image that when read, would cause the application to crash or to leak sensitive data.
Clone Of:
Environment:
Last Closed: 2019-07-16 14:40:45 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2019-07-11 08:56:41 UTC 
A vulnerability was found in Exiv2, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata in mrwimage.cpp

Reference:
https://github.com/Exiv2/exiv2/pull/943
Comment 1 Dhananjay Arunesh 2019-07-11 08:56:52 UTC 
Created exiv2 tracking bugs for this issue:

Affects: fedora-all [bug 1729035]
Comment 2 Riccardo Schirone 2019-07-16 11:57:45 UTC 
Upstream patch:
https://github.com/Exiv2/exiv2/commit/bd0afe0390439b2c424d881c8c6eb0c5624e31d9 [master branch]
https://github.com/Exiv2/exiv2/commit/edb4bf78ca5820f2c7a852c8f2df11e6aba45704 [0.27-maintanance branch]
Comment 3 Riccardo Schirone 2019-07-16 13:27:44 UTC 
Statement:

This issue did not affect the versions of exiv2 as shipped with Red Hat Enterprise Linux 7, and 8 as variables MemIo::Impl::size_ and MemIo::Impl::idx_ are of type long, making it impossible to trigger the integer wraparound that would lead to an out-of-bound read.
Comment 4 Riccardo Schirone 2019-07-16 13:32:30 UTC 
When seeking in MemIo (code in MemIo::Impl::seek) the new position is not properly checked, thus it is possible to move the current position beyond the limits of the memory buffer. If a read is done later (code in MemIo::Impl::read) the maximum number of bytes to read is computed by subtracting the current position value from the buffer's size value. When these two values are implemented as unsigned values (e.g. size_t), the computation may wraparound and more data than what really available would be reported, making it possible to read beyond the buffer's limits.
Comment 5 Product Security DevOps Team 2019-07-16 14:40:45 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-13504
Comment 6 Riccardo Schirone 2019-08-19 16:08:42 UTC 
The flaw seems to be introduced in commit https://github.com/Exiv2/exiv2/commit/c72d16f4c402a8acc2dfe06fe3d58bf6cf99069e, where MemIo::Impl fields were changed from long to size_t.
Note You need to log in before you can comment on or make changes to this bug.