Bug 1959911 (CVE-2021-32614) - CVE-2021-32614 dmg2img: OOB read in memcpy() for up to 204 bytes in fill_mishblk()
Summary: CVE-2021-32614 dmg2img: OOB read in memcpy() for up to 204 bytes in fill_mis...
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2021-32614
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1959912
Blocks: 1955789 1959943
TreeView+ depends on / blocked
 
Reported: 2021-05-12 15:32 UTC by Cedric Buissart
Modified: 2021-05-26 18:33 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in dmg2img through 20170502. fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The length of the buffer is controlled by an attacker. By providing a length smaller than 0xCC, memcpy reaches out of the malloc'ed bound. This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.
Clone Of:
Environment:
Last Closed: 2021-05-13 14:33:52 UTC


Attachments (Terms of Use)

Description Cedric Buissart 2021-05-12 15:32:55 UTC
fill_mishblk() does not check the length of the read buffer, and copy 0xCC bytes from it. The length of the buffer is controlled by an attacker. By providing a length smaller than 0xCC, memcpy reaches out of the malloc'ed bound.
This possibly leads to memory layout information leaking in the data. This might be used in a chain of vulnerability in order to reach code execution.

```
185 void fill_mishblk(char* c, struct _mishblk* m)
186 {
187     memset(m, 0, sizeof(struct _mishblk));
188     memcpy(m, c, 0xCC);
```
In the above code, the memory allocated for `c` may be shorter than 0xCC bytes.

Upstream bug report :
https://github.com/Lekensteyn/dmg2img/issues/11

Comment 1 Cedric Buissart 2021-05-12 15:33:14 UTC
Created dmg2img tracking bugs for this issue:

Affects: fedora-all [bug 1959912]

Comment 2 Cedric Buissart 2021-05-12 15:35:31 UTC
Acknowledgments:

Name: Anshunkang Zhou

Comment 4 Product Security DevOps Team 2021-05-13 14:33:52 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.


Note You need to log in before you can comment on or make changes to this bug.