Bug 1852006 (CVE-2020-15306) - CVE-2020-15306 OpenEXR: Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp
Summary: CVE-2020-15306 OpenEXR: Invalid chunkCount attributes could cause a heap buff...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-15306
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1852007 1852008 1853074 1853075 1910632
Blocks: 1852018
TreeView+ depends on / blocked
 
Reported: 2020-06-29 15:22 UTC by Michael Kaplan
Modified: 2022-04-17 20:57 UTC (History)
6 users (show)

Fixed In Version: OpenEXR 2.5.2
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-11-02 17:14:21 UTC


Attachments (Terms of Use)

Description Michael Kaplan 2020-06-29 15:22:30 UTC
An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.

References:

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md
https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md
https://github.com/AcademySoftwareFoundation/openexr/pull/738
https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2

Comment 1 Michael Kaplan 2020-06-29 15:22:51 UTC
Created OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1852008]


Created mingw-OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1852007]

Comment 2 Todd Cullum 2020-07-01 20:58:41 UTC
The vulnerable getChunkOffsetTableSize() routine uses a parameter to decide when to ignore or not ignore the header's chunkCount; exposing the possibility that the chunkCount could be used even when it should have been ignored. The patch places the rules for when to ignore the chunkCount attribute directly into getChunkOffsetTableSize() so that the callers do not determine this.

Comment 3 Todd Cullum 2020-07-01 21:26:30 UTC
Statement:

This flaw does not affect versions of OpenEXR shipped with Red Hat Enterprise Linux 6 or 7 as the vulnerable code was introduced in subsequent versions of OpenEXR.

Comment 5 Todd Cullum 2020-07-02 21:30:27 UTC
To exploit this flaw, OpenEXR would need to be used in a service which parses untrusted input data, such as data received by a  web server, or in a social engineering attack where a user is tricked into opening a specially crafted file to be parsed by OpenEXR via some application which uses the library, e.g. GIMP.


Note You need to log in before you can comment on or make changes to this bug.