CVE-2017-2920: TALOS-2017-0427 || Cisco Talos Intelligence Group

Summary

An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.

Tested Versions

Computerinsel Photoline 20.02

Product URLs

https://www.pl32.com/

CVSSv3 Score

8.8 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-787: Out-of-bounds Write

Details

The code responsible for the vulnerability is provided below:

.text:00CA765C                 fld     [esp+274h+var_25C_ARG_KONWERS] ; arg
.text:00CA7660                 mov     [esp+274h+var_234], eax
.text:00CA7664                 call    __ftol2_sse              ; float -> int
.text:00CA7669                 mov     [esp+274h+var_230], eax  ; out val

Memset execution:

.text:00822E0B                 mov     eax, [ebp+arg_0_doMEMSET_SIZE_PTR]   
.text:00822E0E                 imul    edx, [eax+4]    ; [eax+4] from __ftol2_sse
.text:00822E12                 push    edx             ; size_t
.text:00822E13                 push    ebx             ; int
.text:00822E14                 push    edi             ; void *
.text:00822E15                 call    _memset         ; bug svg 

Memset function is executed with a size parameter that can be controlled by attacker. The size parameter is calculated from the SVG Path’s D attribute which is a string containing a series of path descriptions (in this case Curveto). This value is later converted from float to int and then later used for multiplication purposes (instruction at 0x00822E0E).

In this case the bug requires the feGaussianBlur filter to be attached to the path style.

Crash Information

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Failed calling InternetOpenUrl, GLE=12029

FAULTING_IP: 
image00400000+b44cbf
00f44cbf f3ab            rep stos dword ptr es:[edi]

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 00f44cbf (image00400000+0x00b44cbf)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 0ac36000
Attempt to write to address 0ac36000

FAULTING_THREAD:  0004afe0

PROCESS_NAME:  image00400000

ERROR_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Instrukcja spod 0x%08lx odwo

EXCEPTION_PARAMETER1:  00000001

EXCEPTION_PARAMETER2:  0ac36000

WRITE_ADDRESS:  0ac36000 

FOLLOWUP_IP: 
image00400000+b44cbf
00f44cbf f3ab            rep stos dword ptr es:[edi]

EXCEPTION_DOESNOT_MATCH_CODE:  This indicates a hardware error.
Instruction at 00f44cbf does not read/write to 0ac36000

DETOURED_IMAGE: 1

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  470

APPLICATION_VERIFIER_FLAGS:  0

BUGCHECK_STR:  APPLICATION_FAULT_STRING_DEREFERENCE_CODE_ADDRESS_MISMATCH_INVALID_POINTER_WRITE_FILL_PATTERN_ffffffff

PRIMARY_PROBLEM_CLASS:  STRING_DEREFERENCE_FILL_PATTERN_ffffffff

DEFAULT_BUCKET_ID:  STRING_DEREFERENCE_FILL_PATTERN_ffffffff

LAST_CONTROL_TRANSFER:  from 0082305c to 00f44cbf

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
0018e0c8 0082305c 050fbcb8 05d50020 7bfe3820 image00400000+0xb44cbf
0018e150 00825ca1 00000000 0018e250 00000003 image00400000+0x42305c
00000000 00000000 00000000 00000000 00000000 image00400000+0x425ca1


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  image00400000+b44cbf

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: image00400000

DEBUG_FLR_IMAGE_TIMESTAMP:  589ee44a

STACK_COMMAND:  ~0s ; kb

FAILURE_BUCKET_ID:  STRING_DEREFERENCE_FILL_PATTERN_ffffffff_c0000005_E:_shitty_programs_photoline_PhotoLine.exe!Unknown

BUCKET_ID:
APPLICATION_FAULT_STRING_DEREFERENCE_CODE_ADDRESS_MISMATCH_INVALID_POINTER_WRITE_FILL_PATTERN_ffffffff_DETOURED
_image004    00000+b44cbf
WATSON_STAGEONE_URL:       
http://watson.microsoft.com/StageOne/image00400000/20_0_0_2/589ee44a/image00400000/20_0_0_2/589ee44a/c0000005/00b44cbf.htm?
Retriage=1


0:000> .exr 0xffffffffffffffff
ExceptionAddress: 00f44cbf (image00400000+0x00b44cbf)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000001
Parameter[1]: 0ac36000
Attempt to write to address 0ac36000
0:000> r
eax=ffffffff ebx=000000ff ecx=1c4eb608 edx=00000000 esi=050fbcb0 edi=0ac36000
eip=00f44cbf esp=0018e06c ebp=0018e0c8 iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
image00400000+0xb44cbf:
00f44cbf f3ab            rep stos dword ptr es:[edi]

Timeline

2017-08-30 - Vendor Disclosure
2017-10-04 - Public Release