Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-30775: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (#464) · Issues · libtiff / libtiff · GitLab

A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.

CVE
#vulnerability#ubuntu#linux#dos#git#buffer_overflow

Skip to content

Open Issue created Sep 19, 2022 by Doudou Huang@Shadowblade

Heap buffer overflow in extractContigSamples32bits, tiffcrop.c

Summary

There is a heap buffer overflow in tiffcrop, extractContigSamples32bits. tiffcrop.c, which could lead to denial of service. This may relate to a incomplete fix of issue #271 (closed).

Version

LIBTIFF, Version 4.4.0, commit 4c3ddd99

Steps to reproduce

Compile with flag

-O0 -g -fsanitize=address

Run

./tiffcrop -i poc /dev/null

Here is the trace reported by ASAN:

==3737423==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d0000000c8 at pc 0x00000053345f bp 0x7ffcd3e96970 sp 0x7ffcd3e96968
READ of size 1 at 0x60d0000000c8 thread T0
    #0 0x53345e in extractContigSamples32bits /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c
    #1 0x53063d in extractContigSamplesToBuffer /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:3716:19
    #2 0x53063d in writeBufferToSeparateStrips /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:1228:11
    #3 0x52050b in writeCroppedImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8209:11
    #4 0x5070c6 in main /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:2442:15
    #5 0x7fefb08db082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #6 0x41d5ad in _start (/benchmark/libtiff/build-a/tools/tiffcrop+0x41d5ad)

0x60d0000000c8 is located 0 bytes to the right of 136-byte region [0x60d000000040,0x60d0000000c8)
allocated by thread T0 here:
    #0 0x4c26cf in malloc /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x5278fd in limitMalloc /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:634:10
    #2 0x5278fd in rotateImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8628:34

SUMMARY: AddressSanitizer: heap-buffer-overflow /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c in extractContigSamples32bits
Shadow bytes around the buggy address:
  0x0c1a7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c1a7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1a7fff8010: 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa
  0x0c1a7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1a7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==3737423==ABORTING

Platform

DISTRIB_ID=Ubuntu DISTRIB_RELEASE=20.04 DISTRIB_CODENAME=focal DISTRIB_DESCRIPTION="Ubuntu 20.04.5 LTS"

poc

Related news

RHSA-2023:2340: Red Hat Security Advisory: libtiff security update

An update for libtiff is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3570: A heap-based buffer overflow flaw was found in Libtiff's tiffcrop utility. This issue occurs during the conversion of a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes an out-of-bound access resulting an application crash, eventually leading to a denial of service. * CVE-2022-3597: An out-o...

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907