Headline
CVE-2023-30775: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (#464) · Issues · libtiff / libtiff · GitLab
A vulnerability was found in the libtiff library. This security flaw causes a heap buffer overflow in extractContigSamples32bits, tiffcrop.c.
Skip to content
Open Issue created Sep 19, 2022 by Doudou Huang@Shadowblade
Heap buffer overflow in extractContigSamples32bits, tiffcrop.c
Summary
There is a heap buffer overflow in tiffcrop, extractContigSamples32bits. tiffcrop.c, which could lead to denial of service. This may relate to a incomplete fix of issue #271 (closed).
Version
LIBTIFF, Version 4.4.0, commit 4c3ddd99
Steps to reproduce
Compile with flag
-O0 -g -fsanitize=address
Run
./tiffcrop -i poc /dev/null
Here is the trace reported by ASAN:
==3737423==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60d0000000c8 at pc 0x00000053345f bp 0x7ffcd3e96970 sp 0x7ffcd3e96968
READ of size 1 at 0x60d0000000c8 thread T0
#0 0x53345e in extractContigSamples32bits /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c
#1 0x53063d in extractContigSamplesToBuffer /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:3716:19
#2 0x53063d in writeBufferToSeparateStrips /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:1228:11
#3 0x52050b in writeCroppedImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8209:11
#4 0x5070c6 in main /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:2442:15
#5 0x7fefb08db082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
#6 0x41d5ad in _start (/benchmark/libtiff/build-a/tools/tiffcrop+0x41d5ad)
0x60d0000000c8 is located 0 bytes to the right of 136-byte region [0x60d000000040,0x60d0000000c8)
allocated by thread T0 here:
#0 0x4c26cf in malloc /dependence/llvm11/llvm-11.0.0.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
#1 0x5278fd in limitMalloc /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:634:10
#2 0x5278fd in rotateImage /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c:8628:34
SUMMARY: AddressSanitizer: heap-buffer-overflow /benchmark/libtiff/build-a/tools/../../tools/tiffcrop.c in extractContigSamples32bits
Shadow bytes around the buggy address:
0x0c1a7fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1a7fff8000: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
=>0x0c1a7fff8010: 00 00 00 00 00 00 00 00 00[fa]fa fa fa fa fa fa
0x0c1a7fff8020: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8030: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8040: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8050: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1a7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==3737423==ABORTING
Platform
DISTRIB_ID=Ubuntu DISTRIB_RELEASE=20.04 DISTRIB_CODENAME=focal DISTRIB_DESCRIPTION="Ubuntu 20.04.5 LTS"
poc
Related news
An update for libtiff is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3570: A heap-based buffer overflow flaw was found in Libtiff's tiffcrop utility. This issue occurs during the conversion of a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes an out-of-bound access resulting an application crash, eventually leading to a denial of service. * CVE-2022-3597: An out-o...