Bug 1915432 (CVE-2020-35655) - CVE-2020-35655 python-pillow: Buffer over-read in SGI RLE image reader
Summary: CVE-2020-35655 python-pillow: Buffer over-read in SGI RLE image reader
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-35655
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1915434 1915435 1915436 1916023
Blocks: 1915433
TreeView+ depends on / blocked
 
Reported: 2021-01-12 16:09 UTC by Michael Kaplan
Modified: 2021-11-09 17:24 UTC (History)
7 users (show)

Fixed In Version: python-pillow 8.1.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in python-pillow. SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
Clone Of:
Environment:
Last Closed: 2021-11-02 18:24:48 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4149 0 None None None 2021-11-09 17:24:20 UTC

Description Michael Kaplan 2021-01-12 16:09:55 UTC
In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

External References: 

https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html#security

Comment 1 Michael Kaplan 2021-01-12 16:12:08 UTC
Created python-pillow tracking bugs for this issue:

Affects: fedora-32 [bug 1915435]
Affects: fedora-33 [bug 1915434]

Comment 5 Todd Cullum 2021-01-14 00:20:34 UTC
Flaw summary:

In `ImagingSgiRleDecode()` of `src/libImaging/SgiRleDecode.c`, it's possible for a call to `malloc()` to request 4 bytes less than necessary, which can lead to a heap buffer overflow -> out-of-bounds read subsequently. The upstream patch moves length checks above the call to `malloc()` and exits `ImagingSgiRleDecode()` with an error code to avoid passing an improper length to `malloc()`.

An attacker who is able to submit a crafted SGI RLE file to an application using python-pillow to decode it, could trigger an out-of-bounds read.

Comment 6 Mark Cooper 2021-01-29 02:07:07 UTC
The following Quay containers contain python-pillow 7.2.0 and hence are affected by the CVE (checked upstream 7.2.0 contains the same vulnerable code):
 - quay-registry-container
 - quay-builder-qemu-rhcos-container

Comment 9 errata-xmlrpc 2021-11-09 17:24:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4149 https://access.redhat.com/errata/RHSA-2021:4149


Note You need to log in before you can comment on or make changes to this bug.