Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 572430 (CVE-2016-1923, CVE-2016-1924) - <media-libs/openjpeg-2.1.1_p20160922: Out-of-bounds Read
Summary: <media-libs/openjpeg-2.1.1_p20160922: Out-of-bounds Read
Status: RESOLVED FIXED
Alias: CVE-2016-1923, CVE-2016-1924
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2016/q1/128
Whiteboard: B2 [glsa cve]
Keywords:
Depends on: CVE-2016-7445
Blocks:
  Show dependency tree
 
Reported: 2016-01-20 09:39 UTC by Agostino Sarubbo
Modified: 2016-12-08 13:57 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-01-20 09:39:29 UTC
From ${URL} :

Hello,
We find two vulnerabilities in the way OpenJpeg's opj_j2k_update_image_data and opj_tgt_reset function  parsed certain 
JPEG 2000 image files.
I was successful in reproducing these issues in the latest version of openjpeg  (https://github.com/uclouvain/openjpeg, 
2016.1.18).

The crash info about opj_j2k_update_image_data function was:
==1630==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xb48010d8 at pc 0x8184862 bp 0xbfff8e58 sp 0xbfff8e50
READ of size 4 at 0xb48010d8 thread T0
==1630==WARNING: Trying to symbolize code, but external symbolizer is not initialized!
    #0 0x8184861 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x8184861)

0xb48010d8 is located 0 bytes to the right of 56-byte region [0xb48010a0,0xb48010d8)
allocated by thread T0 here:
    #0 0x80b5f8e (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x80b5f8e)
    #1 0x81ba220 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x81ba220)
    #2 0x8273db1 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x8273db1)
    #3 0x827c023 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x827c023)
    #4 0x81e0709 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x81e0709)
    #5 0x8212cba (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x8212cba)
    #6 0x82cc849 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x82cc849)
    #7 0x81ac9b6 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x81ac9b6)
    #8 0x80dc56e (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x80dc56e)
    #9 0xb7da2a82 (/lib/i386-linux-gnu/libc.so.6+0x19a82)

SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
  0x369001c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369001d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369001e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x369001f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x36900200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x36900210: fa fa fa fa 00 00 00 00 00 00 00[fa]fa fa fa fa
  0x36900220: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x36900230: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
  0x36900240: fa fa fa fa 00 00 00 00 00 00 00 fa fa fa fa fa
  0x36900250: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
  0x36900260: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:     fa
  Heap right redzone:    fb
  Freed heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==1630==ABORTING
[Inferior 1 (process 1630) exited with code 01]

The crash info about opj_tgt_reset function was:
ASAN:SIGSEGV
=================================================================
==1666==ERROR: AddressSanitizer: SEGV on unknown address 0x00008109 (pc 0x083b06c7 sp 0xbfa06420 bp 0xbfa065b8 T0)
==1666==WARNING: Trying to symbolize code, but external symbolizer is not initialized!
    #0 0x83b06c6 (/home/r/fuzz3/openjpeg-master/bin/opj_decompress+0x83b06c6)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ??:0 ??
==1666==ABORTING

These vulnerabilities ware found by Qihoo 360 Codesafe Team



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Arfrever Frehtes Taifersar Arahesis 2016-08-13 01:51:24 UTC
https://github.com/uclouvain/openjpeg/issues/704
Comment 2 Thomas Deutschmann gentoo-dev Security 2016-09-26 14:09:44 UTC
With the permission of the Gentoo Graphics project I pushed =media-libs/openjpeg-2.1.1_p20160922 into the tree: Actually we wanted to wait for an official v2.1.2 release but upstream postponed the release for another week. Because Gentoo is still at v2.1.0 which has some critical vulnerabilities which are allowing drive-by-download attacks we decided to do a snapshot release.

This snaptshot release (based on v2.1.1) from 2016-09-22 does contain all currently published security fixes, up to CVE-2016-7445:

> commit 30e68615830631059a72b52682ab81bb8b3ca153
> Author: Thomas Deutschmann
> Date:   Mon Sep 26 15:56:16 2016 +0200
> 
>     media-libs/openjpeg: Bump to snapshot release based on v2.1.1 from 2016-09-22
> 
>     Ebuild-releated changes:
>     ========================
>      - EAPI bumped to v6
> 
>      - Test suite re-enabled and fixed (bug #409263)
> 
>     Gentoo-Bug: https://bugs.gentoo.org/409263
>     Gentoo-Bug: https://bugs.gentoo.org/577608
>     Gentoo-Bug: https://bugs.gentoo.org/572430
>     Gentoo-Bug: https://bugs.gentoo.org/560632
>     Gentoo-Bug: https://bugs.gentoo.org/594740
> 
>     Package-Manager: portage-2.3.1
Comment 3 Thomas Deutschmann gentoo-dev Security 2016-12-07 23:59:59 UTC
Added to existing GLSA.
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-12-08 13:57:02 UTC
This issue was resolved and addressed in
 GLSA 201612-26 at https://security.gentoo.org/glsa/201612-26
by GLSA coordinator Aaron Bauman (b-man).