Bug 1056170 (CVE-2017-13735) - VUL-1: CVE-2017-13735: dcraw: There is a floating point exception in the kodak_radc_load_raw functionin dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denialof service attack.
Summary: VUL-1: CVE-2017-13735: dcraw: There is a floating point exception in the koda...
Status: RESOLVED FIXED
Alias: CVE-2017-13735
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/191123/
Whiteboard: CVSSv2:SUSE:CVE-2017-13735:5.0:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-29 14:26 UTC by Marcus Meissner
Modified: 2024-05-06 12:11 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
POC1 (8.76 KB, application/octet-stream)
2017-08-29 14:29 UTC, Marcus Meissner 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-08-29 14:26:52 UTC 
CVE-2017-13735

There is a floating point exception in the kodak_radc_load_raw function
in dcraw_common.cpp in LibRaw 0.18.2. It will lead to a remote denial
of service attack.


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1483988
Comment 1 Marcus Meissner 2017-08-29 14:27:19 UTC 
Description of problem:

There is a floating point exception in dcraw_common.cpp of libRAW. 

Version-Release number of selected component (if applicable):

<= latest version

How reproducible:

./multirender_test POC1

Steps to Reproduce:

$ ./multirender_test POC1
Processing file POC1
Floating point exception

The GDB debugging information is as follows:

$ ./multirender_test POC1
gdb-peda$ r
...

Breakpoint 1, LibRaw::kodak_radc_load_raw (this=0x7ffffff9d6e8) at internal/dcraw_common.cpp:2751
2751		    val = (buf[c][y+1][x] << 4) / mul[c];
gdb-peda$ c 11
Will ignore next 10 crossings of breakpoint 1.  Continuing.

Breakpoint 1, LibRaw::kodak_radc_load_raw (this=0x7ffffff9d6e8) at internal/dcraw_common.cpp:2751
2751		    val = (buf[c][y+1][x] << 4) / mul[c];
gdb-peda$ n

Program received signal SIGFPE, Arithmetic exception.

[----------------------------------registers-----------------------------------]
RAX: 0x1f70 
RBX: 0x0 
RCX: 0x2afa 
RDX: 0x0 
RSI: 0x7ffff7fda0d0 --> 0x1 
RDI: 0x7ffff7d952c0 --> 0x1 
RBP: 0x602878 --> 0x6028a0 --> 0x0 
RSP: 0x7ffffff993a0 --> 0x0 
RIP: 0x7ffff7a65e2b (<LibRaw::kodak_radc_load_raw()+7259>:	idiv   DWORD PTR [rsp+0x9c])
R8 : 0x7ffffff99dec --> 0x11380f00121d10bd 
R9 : 0x0 
R10: 0x7ffffff99dec --> 0x11380f00121d10bd 
R11: 0x14 
R12: 0x0 
R13: 0x7ffffff9d6e8 --> 0x7ffff7d94a30 --> 0x7ffff7b48e10 (<LibRaw::open_datastream(LibRaw_abstract_datastream*)>:	push   rbp)
R14: 0x0 
R15: 0x300
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff7a65e1f <LibRaw::kodak_radc_load_raw()+7247>:	movsx  eax,WORD PTR [rax+rbx*2+0x304]
   0x7ffff7a65e27 <LibRaw::kodak_radc_load_raw()+7255>:	shl    eax,0x4
   0x7ffff7a65e2a <LibRaw::kodak_radc_load_raw()+7258>:	cdq    
=> 0x7ffff7a65e2b <LibRaw::kodak_radc_load_raw()+7259>:	idiv   DWORD PTR [rsp+0x9c]
   0x7ffff7a65e32 <LibRaw::kodak_radc_load_raw()+7266>:	test   eax,eax
   0x7ffff7a65e34 <LibRaw::kodak_radc_load_raw()+7268>:	mov    r15d,0x0
   0x7ffff7a65e3a <LibRaw::kodak_radc_load_raw()+7274>:	cmovns r15w,ax
   0x7ffff7a65e3f <LibRaw::kodak_radc_load_raw()+7279>:	mov    r13,rbp
[------------------------------------stack-------------------------------------]
0000| 0x7ffffff993a0 --> 0x0 
0008| 0x7ffffff993a8 --> 0x700000000 
0016| 0x7ffffff993b0 --> 0x90000000c ('\x0c')
0024| 0x7ffffff993b8 --> 0x8 
0032| 0x7ffffff993c0 --> 0x7ffffff9a6fa --> 0x0 
0040| 0x7ffffff993c8 --> 0x304 
0048| 0x7ffffff993d0 --> 0x7ffffff9a6f8 --> 0x0 
0056| 0x7ffffff993d8 --> 0x0 
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGFPE
0x00007ffff7a65e2b in LibRaw::kodak_radc_load_raw (this=0x7ffffff9d6e8) at internal/dcraw_common.cpp:2751
2751		    val = (buf[c][y+1][x] << 4) / mul[c];
gdb-peda$ x/xw ($rsp+0x9c)
0x7ffffff9943c:	0x00000000
gdb-peda$ 


The vulnerability was triggered in function LibRaw::kodak_radc_load_raw (this=0x7ffffff9d6e8) at internal/dcraw_common.cpp:2751
2749		for (y=0; y < 2; y++)
2750		  for (x=0; x < width/2; x++) {
2751		    val = (buf[c][y+1][x] << 4) / mul[c];
2752		    if (val < 0) val = 0;
2753		    if (c) RAW(row+y*2+c-1,x*2+2-c) = val;
2754		    else   RAW(row+r*2+y,x*2+y) = val;
2755		  }



Actual results:

crash

Expected results:

crash


Additional info:

Credits:

This vulnerability is detected by team OWL337, with our custom fuzzer collAFL. Please contact ganshuitao@gmail.com   and chaoz@tsinghua.edu.cn if you need more info about the team, the tool or the vulnerability.
Comment 2 Marcus Meissner 2017-08-29 14:29:31 UTC 
Created attachment 738684 [details]
POC1

QA REPRODUCER:

dcraw:   dcraw POC1

should not get a floating point exception.

libraw:

shotwell POC1

will use libraw to open it and should not get a float exception.
Comment 3 Marcus Meissner 2017-09-26 04:56:19 UTC 
I split off the libraw part to bug 1060321
Comment 6 Swamp Workflow Management 2022-04-20 10:29:06 UTC 
SUSE-SU-2022:1277-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1056170,1063798,1084690,1097973,1097974,1117436,1117512,1117517,1117622,1117896,1189642
CVE References: CVE-2017-13735,CVE-2017-14608,CVE-2018-19565,CVE-2018-19566,CVE-2018-19567,CVE-2018-19568,CVE-2018-19655,CVE-2018-5801,CVE-2018-5805,CVE-2018-5806,CVE-2021-3624
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    dcraw-9.28.0-150000.3.3.1
openSUSE Leap 15.3 (src):    dcraw-9.28.0-150000.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2022-05-19 19:22:32 UTC 
SUSE-SU-2022:1749-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1056170,1063798,1084690,1097973,1097974,1117436,1117512,1117517,1117622,1117896,1189642
CVE References: CVE-2017-13735,CVE-2017-14608,CVE-2018-19565,CVE-2018-19566,CVE-2018-19567,CVE-2018-19568,CVE-2018-19655,CVE-2018-5801,CVE-2018-5805,CVE-2018-5806,CVE-2021-3624
JIRA References: 
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP5 (src):    dcraw-9.28.0-3.3.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    dcraw-9.28.0-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.