Bug 1026979 (CVE-2017-6827)

Summary:	VUL-1: CVE-2017-6827: audiofile: heap-based buffer overflow in MSADPCM::initializeCoefficients (MSADPCM.cpp)
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Mikhail Kasimov <mikhail.kasimov>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P4 - Low	CC:	alarrosa, gnome-bugs, jsegitz, vpereira
Version:	unspecified
Target Milestone:	unspecified
Hardware:	Other
OS:	Other
Whiteboard:	CVSSv2:NVD:CVE-2017-6827:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv3:NVD:CVE-2017-6827:7.8:(AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv3:RedHat:CVE-2017-6827:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Mikhail Kasimov 2017-02-26 12:39:03 UTC

Ref: http://seclists.org/oss-sec/2017/q1/505
=============================================

=============================================

https://software.opensuse.org/package/audiofile

TW|42.{1,2}: 0.3.6

VUL-1 because: http://seclists.org/oss-sec/2017/q1/504
========================================================
Hello all.

I discovered multiple crashes in the audiofile library.
The maintainer was informed privately, I didn't see reactions and all details are public on my blog.
I posted them to the cveform too, but I didn't get response.
I'll send update if something will change. 

--
Agostino Sarubbo
Gentoo Linux Developer
========================================================

Comment 1 Mikhail Kasimov 2017-02-26 12:40:14 UTC

Oops, sorry...

Ref: http://seclists.org/oss-sec/2017/q1/505
=============================================
Description:
audiofile is a C-based library for reading and writing audio files in many common formats.

A fuzz with a wav file as input produced an heap overflow.

The complete ASan output:

# sfinfo $FILE
==6096==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61a00001f708 at pc 0x0000004bbc35 bp 0x7ffd65dbabf0 
sp 0x7ffd65dba3a0                                                       
READ of size 33872 at 0x61a00001f708 thread T0                                                                          
                                                                       
    #0 0x4bbc34 in __asan_memcpy 
/tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413            
                                      
    #1 0x7efec209d7df in MSADPCM::initializeCoefficients() 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/modules/MSADPCM.cpp:369:3                  
            
    #2 0x7efec209d7df in MSADPCM::createDecompress(Track*, File*, bool, bool, long*) 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/modules/MSADPCM.cpp:387      
    #3 0x7efec2070da7 in ModuleState::initFileModule(_AFfilehandle*, Track*) 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/modules/ModuleState.cpp:72:18        
    #4 0x7efec207189d in ModuleState::init(_AFfilehandle*, Track*) 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/modules/ModuleState.cpp:98:6               
    
    #5 0x7efec2053969 in _afOpenFile(int, File*, char const*, _AFfilehandle**, _AFfilesetup*) 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/openclose.cpp:396:18
    #6 0x7efec2054331 in afOpenFile 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/openclose.cpp:217:6                        
                                   
    #7 0x50a278 in printfileinfo 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/sfcommands/printinfo.c:45:22                            
                                      
    #8 0x509f98 in main /tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/sfcommands/sfinfo.c:113:4       
                                                                       
    #9 0x7efec111d78f in __libc_start_main 
/tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289                                         
                            
    #10 0x419b68 in _init (/usr/bin/sfinfo+0x419b68)                                                                    
                                                                       
                                                                                                                        
                                                                       
0x61a00001f708 is located 0 bytes to the right of 1160-byte region [0x61a00001f280,0x61a00001f708)                      
                                                                       
allocated by thread T0 here:                                                                                            
                                                                       
    #0 0x4d2928 in malloc 
/tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:64             
                                             
    #1 0x7efec0b7c687 in operator new(unsigned long) (/usr/lib/gcc/x86_64-pc-linux-gnu/6.3.0/libstdc++.so.6+0xb2687)    
                                                                       
    #2 0x7efec2052d63 in _afOpenFile(int, File*, char const*, _AFfilehandle**, _AFfilesetup*) 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/openclose.cpp:337:15
    #3 0x7efec2054331 in afOpenFile 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/libaudiofile/openclose.cpp:217:6                        
                                   
    #4 0x50a278 in printfileinfo 
/tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/sfcommands/printinfo.c:45:22                            
                                      
    #5 0x509f98 in main /tmp/portage/media-libs/audiofile-0.3.6-r3/work/audiofile-0.3.6/sfcommands/sfinfo.c:113:4       
                                                                       
    #6 0x7efec111d78f in __libc_start_main 
/tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289                                         
                            
                                                                                                                        
                                                                       
SUMMARY: AddressSanitizer: heap-buffer-overflow 
/tmp/portage/sys-devel/llvm-3.9.1/work/llvm-3.9.1.src/projects/compiler-rt/lib/asan/asan_interceptors.cc:413 in 
__asan_memcpy                  
Shadow bytes around the buggy address:                                                                                  
                                                                       
  0x0c347fffbe90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c347fffbed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c347fffbee0: 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbef0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c347fffbf30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==6096==ABORTING

Affected version:
0.3.6

Fixed version:
N/A

Commit fix:
N/A

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00136-audiofile-heapoverflow-MSADPCM-initializeCoefficients

Timeline:
2017-01-30: bug discovered and reported to upstream
2017-02-20: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:
https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-msadpcminitializecoefficients-msadpcm-cpp
=============================================

Comment 2 Swamp Workflow Management 2017-02-26 23:00:29 UTC

bugbot adjusting priority

Comment 4 Antonio Larrosa 2017-03-06 16:05:48 UTC

The fix for boo#1026978 also fixes this one.

Comment 5 Antonio Larrosa 2017-03-09 10:12:33 UTC

The check for the number of coefficients also fixes this issue.

*** This bug has been marked as a duplicate of bug 1026978 ***

Comment 11 Swamp Workflow Management 2017-04-05 16:17:55 UTC

SUSE-SU-2017:0940-1: An update that fixes 14 vulnerabilities is now available.

Category: security (low)
Bug References: 1026978,1026979,1026980,1026981,1026982,1026983,1026984,1026985,1026986,1026987,1026988,949399
CVE References: CVE-2015-7747,CVE-2017-6827,CVE-2017-6828,CVE-2017-6829,CVE-2017-6830,CVE-2017-6831,CVE-2017-6832,CVE-2017-6833,CVE-2017-6834,CVE-2017-6835,CVE-2017-6836,CVE-2017-6837,CVE-2017-6838,CVE-2017-6839
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Server 12-SP2 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Server 12-SP1 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    audiofile-0.3.6-10.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    audiofile-0.3.6-10.1

Comment 13 Swamp Workflow Management 2017-04-18 10:16:05 UTC

openSUSE-SU-2017:1038-1: An update that fixes 13 vulnerabilities is now available.

Category: security (low)
Bug References: 1026978,1026979,1026980,1026981,1026982,1026983,1026984,1026985,1026986,1026987,1026988
CVE References: CVE-2017-6827,CVE-2017-6828,CVE-2017-6829,CVE-2017-6830,CVE-2017-6831,CVE-2017-6832,CVE-2017-6833,CVE-2017-6834,CVE-2017-6835,CVE-2017-6836,CVE-2017-6837,CVE-2017-6838,CVE-2017-6839
Sources used:
openSUSE Leap 42.2 (src):    audiofile-0.3.6-10.3.1
openSUSE Leap 42.1 (src):    audiofile-0.3.6-12.1

Comment 15 Swamp Workflow Management 2017-05-05 13:09:38 UTC

SUSE-SU-2017:1182-1: An update that fixes 13 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1026978,1026979,1026980,1026981,1026982,1026983,1026984,1026985,1026986,1026987,1026988
CVE References: CVE-2017-6827,CVE-2017-6828,CVE-2017-6829,CVE-2017-6830,CVE-2017-6831,CVE-2017-6832,CVE-2017-6833,CVE-2017-6834,CVE-2017-6835,CVE-2017-6836,CVE-2017-6837,CVE-2017-6838,CVE-2017-6839
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    audiofile-0.2.6-142.17.1
SUSE Linux Enterprise Server 11-SP4 (src):    audiofile-0.2.6-142.17.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    audiofile-0.2.6-142.17.1

Comment 17 Marcus Meissner 2017-07-13 12:36:58 UTC

released