pax-utils: scanelf: out of bounds read in scanelf_file_textrel (scanelf.c)

Posted on February 1, 2017 by ago

Description:
pax-utils is a set of tools that check files for security relevant properties.

A fuzz on scanelf exposed an out-of bound read. It was reported to vapier which fixed the issue immediately.
Unfortunately I can’t get a symbolized ASan stacktrace, so I will show only the useful part of both asan and gdb.

# scanelf -s '*' -axetrnibSDIYZB $FILE
==1853==ERROR: AddressSanitizer: unknown-crash on address 0x7f4099d25008 at pc 0x00000053586e bp 0x7fff335cb8b0 sp 0x7fff335cb8a8
READ of size 8 at 0x7f4099d25008 thread T0
    #0 0x53586d  (/usr/bin/scanelf+0x53586d)
    #1 0x51f526  (/usr/bin/scanelf+0x51f526)
    #2 0x51b97e  (/usr/bin/scanelf+0x51b97e)
    #3 0x51ad43  (/usr/bin/scanelf+0x51ad43)
    #4 0x51922e  (/usr/bin/scanelf+0x51922e)
    #5 0x7f4098afd61f  (/lib64/libc.so.6+0x2061f)
    #6 0x41a008  (/usr/bin/scanelf+0x41a008) 

(gdb) bt
#8  0x000000000053586e in scanelf_file_textrel (elf=, found_textrel=) at scanelf.c:560
#9  0x000000000051f527 in scanelf_elfobj (elf=) at scanelf.c:1536
#10 0x000000000051b97f in scanelf_elf (filename=0x7fffffffe50e "/tmp/afl/scanelf/report/crashes/2.crashes", fd=, len=) at scanelf.c:1612
#11 scanelf_fileat (dir_fd=, filename=, st_cache=) at scanelf.c:1679
#12 0x000000000051ad44 in scanelf_dirat (dir_fd=, path=) at scanelf.c:1713
#13 0x000000000051922f in scanelf_dir (path=) at scanelf.c:1763
#14 parseargs (argc=5, argv=0x7fffffffe258) at scanelf.c:2273
#15 main (argc=5, argv=) at scanelf.c:2361

Affected version:
1.2

Fixed version:
1.2.1

Commit fix:
https://github.com/gentoo/pax-utils/commit/95e5489534ac9e9324c5096286899b688e19ae00

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00132-pax-utils-scanelf-oobread-scanelf_file_textrel

Timeline:
2017-01-23: bug discovered and reported to upstream
2017-01-24: upstream realeased a patch and 1.2.1
2017-02-01: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.
I’d suggest to go to 1.2.2 because of a functionality bug(s) in 1.2.1

Permalink:
https://blogs.gentoo.org/ago/2017/02/01/pax-utils-scanelf-out-of-bounds-read-in-scanelf_file_textrel-scanelf-c

Posted in advisories, gentoo, security | 1 Comment

mp3splt: NULL pointer dereference in free_options (options_manager.c)

Posted on February 1, 2017 by ago

Description:
mp3splt is a command line utility to split mp3 and ogg files without decoding.

A fuzz on it discovered a NULL pointer access.

The complete ASan output:

# mp3splt -P -f -t 0.1 -a $FILE
==3026==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000041ea65 bp 0x331bdacc2c238b55 sp 0x7fff34d2c400 T0)                                                                                                                                         
    #0 0x41ea64 in atomic_compare_exchange_strong /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81                                                          
    #1 0x41ea64 in __asan::Allocator::AtomicallySetQuarantineFlagIfAllocated(__asan::AsanChunk*, void*, __sanitizer::BufferedStackTrace*) /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_allocator.cc:468                         
    #2 0x41ea64 in __asan::Allocator::Deallocate(void*, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_allocator.cc:522                                       
    #3 0x41ea64 in __asan::asan_free(void*, __sanitizer::BufferedStackTrace*, __asan::AllocType) /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_allocator.cc:725                                                                  
    #4 0x4d374c in free /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:50                                                                                                                                         
    #5 0x50db0e in free_options /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/options_manager.c:61:9                                                                                                                                                           
    #6 0x515623 in free_main_struct /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/data_manager.c:74:7                                                                                                                                                          
    #7 0x50ffa5 in process_confirmation_error /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/print_utils.c:266:7                                                                                                                                                
    #8 0x51df29 in main /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/mp3splt.c:873:9                                                                                                                                                                          
    #9 0x7f8a687f861f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289                                                                                                                                                        
    #10 0x41ad08 in _init (/usr/bin/mp3splt+0x41ad08)                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                               
AddressSanitizer can not provide additional info.                                                                                                                                                                                                                              
SUMMARY: AddressSanitizer: SEGV /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81 in atomic_compare_exchange_strong                                          
==3026==ABORTING

Affected version:
0.9.2

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-5851

Reproducer:
https://github.com/asarubbo/poc/blob/master/00127-mp3splt-nullptr-free_options

Timeline:
2017-01-01: privately poked upstream about
2017-02-01: blog post about the issue
2017-02-02: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/02/01/mp3splt-null-pointer-dereference-in-free_options-options_manager-c

Posted in advisories, security | 1 Comment

libmp3splt: NULL pointer dereference in splt_cue_export_to_file (cue.c)

Posted on January 29, 2017 by ago

Description:
libmp3splt a library for mp3splt to split mp3 and ogg files without decoding.

A fuzz on it discovered a NULL pointer access.

The complete ASan output:

# mp3splt -P -f -t 0.1 -a $FILE
==2581==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f36fb0a159a bp 0x7ffdc2708cb0 sp 0x7ffdc2708438 T0)
==2581==The signal is caused by a READ memory access.
==2581==Hint: address points to the zero page.
    #0 0x7f36fb0a1599 in strlen /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/string/../sysdeps/x86_64/strlen.S:76
    #1 0x47a571 in __interceptor_fopen64 /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:5167
    #2 0x7f36fbf0d27e in splt_cue_export_to_file /tmp/portage/media-libs/libmp3splt-0.9.2/work/libmp3splt-0.9.2/src/cue.c:725
    #3 0x7f36fbf0911b in mp3splt_export /tmp/portage/media-libs/libmp3splt-0.9.2/work/libmp3splt-0.9.2/src/mp3splt.c:1665
    #4 0x51d5f0 in main /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/mp3splt.c:901:13
    #5 0x7f36fb04061f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #6 0x41ad08 in _init (/usr/bin/mp3splt+0x41ad08)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/string/../sysdeps/x86_64/strlen.S:76 in strlen
==2581==ABORTING

Affected version:
0.9.2

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-5665

Reproducer:
https://github.com/asarubbo/poc/blob/master/00129-mp3splt-nullptr-splt_cue_export_to_file

Timeline:
2017-01-01: private report to upstream via mail
2017-01-29: public upstream report on sourceforge
2017-01-29: blog post about the issue
2017-01-31: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:

libmp3splt: NULL pointer dereference in splt_cue_export_to_file (cue.c)

Posted in advisories, security | 1 Comment

mp3splt: invalid free in free_options (options_manager.c)

Posted on January 29, 2017 by ago

Description:
mp3splt is a command line utility to split mp3 and ogg files without decoding.

A fuzz on it discovered an invalid free.

The complete ASan output:

# mp3splt -P -f -t 0.1 -a $FILE
==2631==ERROR: AddressSanitizer: attempting free on address which was not malloc()-ed: 0x000000d3ef65 in thread T0
    #0 0x4d3770 in free /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47
    #1 0x50dbaa in free_options /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/options_manager.c:67:9
    #2 0x515623 in free_main_struct /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/data_manager.c:74:7
    #3 0x50ffa5 in process_confirmation_error /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/print_utils.c:266:7
    #4 0x51df29 in main /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/mp3splt.c:873:9
    #5 0x7f783aba361f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #6 0x41ad08 in _init (/usr/bin/mp3splt+0x41ad08)

AddressSanitizer can not describe address in more detail (wild memory access suspected).
SUMMARY: AddressSanitizer: bad-free /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:47 in free
==2631==ABORTING

Affected version:
0.9.2

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-5666

Reproducer:
https://github.com/asarubbo/poc/blob/master/00130-mp3splt-badfree-free_options

Timeline:
2017-01-01: private report to upstream via mail
2017-01-29: public upstream report on sourceforge
2017-01-29: blog post about the issue
2017-01-31: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/01/29/mp3splt-invalid-free-in-free_options-options_manager-c

Posted in advisories, security | 16 Comments

mp3splt: NULL pointer dereference in main (mp3splt.c)

Posted on January 29, 2017 by ago

Description:
mp3splt is a command line utility to split mp3 and ogg files without decoding.

A fuzz on it discovered a NULL pointer access.

The complete ASan output:

# mp3splt -P -f -t 0.1 -a $FILE
==3081==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000046dbd9 bp 0x7ffc4cdabdb0 sp 0x7ffc4cdab520 T0)
==3081==The signal is caused by a READ memory access.
==3081==Hint: address points to the zero page.
    #0 0x46dbd8 in __interceptor_strncmp /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:302
    #1 0x51d727 in main /tmp/portage/media-sound/mp3splt-2.6.2/work/mp3splt-2.6.2/src/mp3splt.c:906:11
    #2 0x7f8512cf061f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #3 0x41ad08 in _init (/usr/bin/mp3splt+0x41ad08)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/sys-devel/llvm-3.9.0-r1/work/llvm-3.9.0.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:302 in __interceptor_strncmp
==3081==ABORTING

Affected version:
0.9.2

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00128-mp3splt-nullptr-main

Timeline:
2017-01-01: private report to upstream via mail
2017-01-29: public upstream report on sourceforge
2017-01-29: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/01/29/mp3splt-null-pointer-dereference-in-mp3splt-c

Posted in advisories, security | Leave a comment

jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c)

Posted on January 25, 2017 by ago

Description:
jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Another round of fuzzing shows that a crafted image causes a read overflow.

The complete ASan output:

# imginfo -f $FILE
warning: ignoring unknown marker segment (0xff70)
type = 0xff70 (UNKNOWN); len = 35;00 01 43 72 65 61 74 6f 74 3a 30 4a 61 73 50 65 72 00 01 00 00 73 69 6f 6e 20 31 2e 39 30 30 2e 39 warning: trailing garbage in marker segment (3 bytes)
warning: trailing garbage in marker segment (8 bytes)
warning: trailing garbage in marker segment (6 bytes)
=================================================================
==30315==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a00001f808 at pc 0x7fb7b2667e54 bp 0x7ffd0a9ab890 sp 0x7ffd0a9ab888
READ of size 8 at 0x61a00001f808 thread T0
    #0 0x7fb7b2667e53 in jpc_dec_decodepkt /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14
    #1 0x7fb7b2667e53 in jpc_dec_decodepkts /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:454
    #2 0x7fb7b25ccd37 in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:628:6
    #3 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10
    #4 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262
    #5 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21
    #6 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16
    #7 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16
    #8 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289
    #9 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8)

0x61a00001f808 is located 48 bytes to the right of 1368-byte region [0x61a00001f280,0x61a00001f7d8)
allocated by thread T0 here:
    #0 0x4d2a98 in malloc /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64
    #1 0x7fb7b2575160 in jas_malloc /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:242:11
    #2 0x7fb7b2575160 in jas_alloc2 /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_malloc.c:275
    #3 0x7fb7b25ca2bf in jpc_dec_tileinit /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:841:24
    #4 0x7fb7b25ca2bf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:594
    #5 0x7fb7b25d6853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10
    #6 0x7fb7b25d6853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262
    #7 0x7fb7b25a6231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21
    #8 0x7fb7b2568214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16
    #9 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16
    #10 0x7fb7b164878f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289

SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_t2dec.c:245:14 in jpc_dec_decodepkt
Shadow bytes around the buggy address:
  0x0c347fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbef0: 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa
=>0x0c347fffbf00: fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==30315==ABORTING

Affected version:
2.0.10

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-6852

Reproducer:
https://github.com/asarubbo/poc/blob/master/00126-jasper-heapoverflow-jpc_dec_decodepkt

Timeline:
2017-01-25: bug discovered and reported upstream
2017-01-25: blog post about the issue
2017-03-12: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:

jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c)

Posted in advisories, security | Leave a comment

jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c)

Posted on January 25, 2017 by ago

Description:
jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Another round of fuzzing shows that a crafted image causes an invalid memory read.

The complete ASan output:

# imginfo -f $FILE
warning: ignoring unknown marker segment (0xff59)
type = 0xff59 (UNKNOWN); len = 20;00 40 40 00 00 00 00 69 00 00 00 00 00 00 00 00 00 00 warning: ignoring unknown marker segment (0xff46)
type = 0xff46 (UNKNOWN); len = 20;01 40 40 00 00 00 00 00 00 00 00 00 00 00 12 00 94 7f ASAN:DEADLYSIGNAL
=================================================================
==22653==ERROR: AddressSanitizer: SEGV on unknown address 0x60180000ec30 (pc 0x7f410df421b7 bp 0x7ffdc80abaf0 sp 0x7ffdc80aba60 T0)
==22653==The signal is caused by a READ memory access.
    #0 0x7f410df421b6 in jas_matrix_bindsub /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_seq.c:254:18
    #1 0x7f410df951a1 in jpc_dec_tileinit /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:835:5
    #2 0x7f410df951a1 in jpc_dec_process_sod /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:594
    #3 0x7f410dfa1853 in jpc_dec_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:425:10
    #4 0x7f410dfa1853 in jpc_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jpc/jpc_dec.c:262
    #5 0x7f410df71231 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:218:21
    #6 0x7f410df33214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16
    #7 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16
    #8 0x7f410d01378f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289
    #9 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_seq.c:254:18 in jas_matrix_bindsub
==22653==ABORTING

Affected version:
2.0.10

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-6851

Reproducer:
https://github.com/asarubbo/poc/blob/master/00125-jasper-invalidread-jas_matrix_bindsub

Timeline:
2017-01-21: bug discovered and reported upstream
2017-01-25: blog post about the issue
2017-03-12: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:

jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c)

Posted in advisories, security | Leave a comment

jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)

Posted on January 25, 2017 by ago

Description:
jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Another round of fuzzing shows that a crafted image causes a NULL pointer access.

The complete ASan output:

# imginfo -f $FILE
cannot parse box data
ASAN:DEADLYSIGNAL
=================================================================
==6697==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00000041da35 bp 0xbebebebebebebeae sp 0x7fff60ad6480 T0)
    #0 0x41da34 in atomic_compare_exchange_strong /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81
    #1 0x41da34 in __asan::Allocator::AtomicallySetQuarantineFlagIfAllocated(__asan::AsanChunk*, void*, __sanitizer::BufferedStackTrace*) /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:468
    #2 0x41da34 in __asan::Allocator::Deallocate(void*, unsigned long, __sanitizer::BufferedStackTrace*, __asan::AllocType) /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:522
    #3 0x41da34 in __asan::asan_free(void*, __sanitizer::BufferedStackTrace*, __asan::AllocType) /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_allocator.cc:725
    #4 0x4d271c in free /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:50
    #5 0x7f86ef11c995 in jp2_cdef_destroy /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:230:3
    #6 0x7f86ef11e18e in jp2_box_destroy /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:212:3
    #7 0x7f86ef11e18e in jp2_box_get /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_cod.c:319
    #8 0x7f86ef1219f6 in jp2_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/jp2/jp2_dec.c:159:16
    #9 0x7f86ef0e4214 in jas_image_decode /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/libjasper/base/jas_image.c:444:16
    #10 0x50a3be in main /tmp/portage/media-libs/jasper-2.0.10/work/jasper-2.0.10/src/appl/imginfo.c:238:16
    #11 0x7f86ee1c478f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289
    #12 0x419cd8 in _start (/usr/bin/imginfo+0x419cd8)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_atomic_clang.h:81 in atomic_compare_exchange_strong
==6697==ABORTING

Affected version:
2.0.10

Fixed version:
2.0.13 (not released atm)

Commit fix:
https://github.com/mdadams/jasper/commit/e96fc4fdd525fa0ede28074a7e2b1caf94b58b0d

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-6850

Reproducer:
https://github.com/asarubbo/poc/blob/master/00124-jasper-nullptr-jp2_cdef_destroy

Timeline:
2017-01-18: bug discovered and reported upstream
2017-01-25: blog post about the issue
2017-03-04: upstream released a patch
2017-03-12: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:

jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)

Posted in advisories, security | Leave a comment

<sys-libs/zlib-1.2.11 – possible data corruption

Posted on January 16, 2017 by ago

I don’t know if a news will be sent. A possibile data corruption was found on zlib 1.2.10.
Please update your zlib to 1.2.11 and make sure you restart all services that are linked to zlib (a reboot may be an easy way).

Gentoo bug:
https://bugs.gentoo.org/show_bug.cgi?id=605888

Upstream bug:
https://github.com/madler/zlib/issues/198

Upstream commit:
https://github.com/madler/zlib/commit/4c7c90768308587884fab6159d93a4695a5ab1f0</a

Posted in gentoo | Leave a comment

jasper: invalid memory read in jas_matrix_asl (jas_seq.c)

Posted on January 16, 2017 by ago

Description:
jasper is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard.

Another round of fuzzing shows that a crafted image causes an invalid memory read.

The complete ASan output:

# imginfo -f $FILE
==26941==ERROR: AddressSanitizer: SEGV on unknown address 0x62c80000a400 (pc 0x7f28c74e48ee bp 0x7ffcececdb70 sp 0x7ffcececdaf0 T0)
==26941==The signal is caused by a READ memory access.
    #0 0x7f28c74e48ed in jas_matrix_asl /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/base/jas_seq.c:376:11
    #1 0x7f28c7545f0e in jpc_dec_tiledecode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:1107:6
    #2 0x7f28c7536cdf in jpc_dec_process_sod /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:658:7
    #3 0x7f28c75406b3 in jpc_dec_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:425:10
    #4 0x7f28c75406b3 in jpc_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/jpc/jpc_dec.c:262
    #5 0x7f28c74a2b84 in jas_image_decode /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/base/jas_image.c:444:16
    #6 0x509eed in main /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/appl/imginfo.c:219:16
    #7 0x7f28c65aa61f in __libc_start_main /var/tmp/portage/sys-libs/glibc-2.22-r4/work/glibc-2.22/csu/libc-start.c:289
    #8 0x419978 in _init (/usr/bin/imginfo+0x419978)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/portage/media-libs/jasper-1.900.27/work/jasper-1.900.27/src/libjasper/base/jas_seq.c:376:11 in jas_matrix_asl
==26941==ABORTING

Affected version:
1.900.27

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
CVE-2017-5505

Reproducer:
https://github.com/asarubbo/poc/blob/master/00053-jasper-invalidread-jas_matrix_asl

Timeline:
2016-11-20: bug discovered and reported upstream
2017-01-16: blog post about the issue
2017-01-17: CVE assigned

Note:
This bug was found with American Fuzzy Lop.

Permalink:

jasper: invalid memory read in jas_matrix_asl (jas_seq.c)

Posted in advisories, security | Leave a comment