Bug 1027025 (CVE-2017-6314)

Summary: VUL-1: CVE-2017-6314: gdk-pixbuf: Infinite loop in io-tiff.c
Product: [Novell Products] SUSE Security Incidents Reporter: Marcus Meissner <meissner>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P4 - Low CC: mgorse, sreeves, wolfgang.frisch, yfjiang
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/180941/
See Also: http://bugzilla.suse.com/show_bug.cgi?id=991450
Whiteboard: CVSSv2:SUSE:CVE-2017-6314:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3.1:SUSE:CVE-2017-6314:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Marcus Meissner 2017-02-27 07:30:33 UTC 
http://seclists.org/oss-sec/2017/q1/466

2. Infinite loop in io-tiff.c [2]
---------------------------------
This loader for tiff images will try and allocate a buffer as big as size
given to it. It calls the make_available_at_least function to do that.
The problem is in the function itself (from line 499):

if (need_alloc > context->allocated) {
    guint new_size = 1;
    while (new_size < need_alloc)
        new_size *= 2;
...

new_size starts with 1 and multiplies until it is larger or equal to
need_alloc. If need_alloc is larger than 2^31, new_size will become 2^31
and multiply itself in 2, and become 0. This would lead to an infinite loop.

CVE-2017-6314
Comment 1 Marcus Meissner 2017-02-27 07:34:20 UTC 
https://bugzilla.gnome.org/show_bug.cgi?id=779020
Comment 2 Swamp Workflow Management 2017-02-27 23:00:51 UTC 
bugbot adjusting priority
Comment 3 Marcus Meissner 2017-02-28 16:59:55 UTC 
no testcase or patch in gnome bug so far.

A check against INT_MAX or similar might be useful.
Comment 4 Scott Reeves 2017-03-03 22:40:02 UTC 
Hi Yifan, can you have someone on your team take this.
Comment 5 Yifan Jiang 2017-03-06 02:46:44 UTC 
Hi Xiaoguang,

Would you help to take care of this, thank you!
Comment 10 Swamp Workflow Management 2017-09-06 19:07:51 UTC 
SUSE-SU-2017:2381-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027024,1027025,1027026,1048289,1048544,1049877
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
Comment 11 Swamp Workflow Management 2017-09-08 19:07:37 UTC 
openSUSE-SU-2017:2393-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027024,1027025,1027026,1048289,1048544,1049877
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
openSUSE Leap 42.3 (src):    gdk-pixbuf-2.34.0-10.1
openSUSE Leap 42.2 (src):    gdk-pixbuf-2.34.0-7.3.1
Comment 13 Hans Petter Jansson 2018-04-30 15:19:00 UTC 
Closing as fixed.
Comment 19 Swamp Workflow Management 2018-08-21 16:10:22 UTC 
SUSE-SU-2018:2470-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1027024,1027025,1027026,1039465,1048289,1048544
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
SUSE Linux Enterprise Server 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
Comment 20 Marcus Meissner 2018-10-10 13:52:25 UTC 
we are still tracking this unfixed for SLE-11 gdk-pixbuf
Comment 21 Michael Gorse 2019-08-15 21:53:57 UTC 
The relevant code isn't in SLE-11 gdk-pixbuf. In newer versions of gdk-pixbuf/gtk2, make_available_at_least is called by gdk_pixbuf_tiff_image_load_increment, but, in SLE-11 gdk-pixbuf, that function just calls fwrite and doesn't do any memory allocation.
Comment 23 Marcus Meissner 2022-01-23 14:33:03 UTC 
done