Bug 947122 (CVE-2015-7313) - VUL-0: CVE-2015-7313: tiff: crafted tiff file could lead to OOM kill denial of service
Summary: VUL-0: CVE-2015-7313: tiff: crafted tiff file could lead to OOM kill denial o...
Status: RESOLVED WONTFIX
Alias: CVE-2015-7313
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Fridrich Strba
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/156907/
Whiteboard: CVSSv2:RedHat:CVE-2015-7313:2.1:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-09-23 10:00 UTC by Victor Pereira
Modified: 2020-04-01 22:15 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
reproducer (98 bytes, application/x-gzip)
2015-09-23 10:00 UTC, Victor Pereira 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2015-09-23 10:00:41 UTC 
Created attachment 648701 [details]
reproducer

CVE-2015-7313

it was found a DoS using a crafted tiff file that causes a OOM kill in low memory
system (usually less than 3GB). This was tested in Ubuntu 14.04 (64bit) but the
issue exists even in the CVS libtiff version. Please find attached the
compressed test case (otherwise it can kill my browser since gdk-pixbuf is
loading tiff files in the preview dialog!). You can test it executing:

$ tiffdither oom.tif /dev/null

If you run it with ltrace, you can see some very large reallocs:

libtiff.so.5->realloc(0, 1636178024)
             = 0x7f71a42b6010
libtiff.so.5->realloc(0, 1636178024)
             = 0x7f7142a54010



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7313
http://seclists.org/oss-sec/2015/q3/621
Comment 1 Swamp Workflow Management 2015-09-23 22:00:16 UTC 
bugbot adjusting priority
Comment 2 Andreas Stieger 2015-10-08 13:01:42 UTC 
Not a security issue, it simply uses a lot of memory.
( /proc/sys/vm/overcommit_memory is default at 0)
This is not in the libtiff code, and is more a peculiarity of vm systems with overcommit.