Bug 1036945 (CVE-2017-8363)

Summary: VUL-0: CVE-2017-8363: libsndfile: heap-based buffer overflow in flac_buffer_copy (flac.c)
Product: [Novell Products] SUSE Security Incidents Reporter: Mikhail Kasimov <mikhail.kasimov>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P4 - Low CC: jsegitz, meissner, tiwai
Version: unspecified   
Target Milestone: unspecified   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/184594/
Whiteboard: CVSSv2:NVD:CVE-2017-8363:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:NVD:CVE-2017-8363:5.5:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSSv2:SUSE:CVE-2017-8363:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) maint:released:sle10-sp3:63617 CVSSv3:RedHat:CVE-2017-8363:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: libsndfile-heapoverflow-flac_buffer_copy_reproducer

Description Mikhail Kasimov 2017-04-29 16:10:13 UTC 
Created attachment 723235 [details]
libsndfile-heapoverflow-flac_buffer_copy_reproducer

Ref: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/
===========================================================
Description:
libsndfile is a C library for reading and writing files containing sampled sound.

The complete ASan output of the issue:

# sndfile-convert $FILE out.wav
==26966==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000001110 at pc 0x7fd12fe865e6 bp 0x7ffea55e99f0 sp 0x7ffea55e99e8
READ of size 4 at 0x621000001110 thread T0
    #0 0x7fd12fe865e5 in flac_buffer_copy /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41
    #1 0x7fd12fe86ef4 in flac_read_loop /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:928:3
    #2 0x7fd12fe721fb in flac_read_flac2i /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:979:13
    #3 0x7fd12fdca3a2 in sf_readf_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/sndfile.c:1835:10
    #4 0x514b5d in sfe_copy_data_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/common.c:87:16
    #5 0x5138d1 in main /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/sndfile-convert.c:340:3
    #6 0x7fd12ed6578f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289
    #7 0x419e18 in _init (/usr/bin/sndfile-convert+0x419e18)

0x621000001110 is located 0 bytes to the right of 4112-byte region [0x621000000100,0x621000001110)
allocated by thread T0 here:
    #0 0x4d94e8 in malloc /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:66
    #1 0x7fd12eb2d492 in safe_malloc_muladd2_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/include/share/alloc.h:153
    #2 0x7fd12eb2d492 in allocate_output_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:1294
    #3 0x7fd12eb2d492 in read_frame_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:2035

SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41 in flac_buffer_copy
Shadow bytes around the buggy address:
  0x0c427fff81d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff81e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fff8220: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==26966==ABORTING

Affected version:
1.0.28

Fixed version:
N/A

Commit fix:
https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3

Credit:
This bug was discovered by Agostino Sarubbo of Gentoo.

CVE:
N/A

Reproducer:
https://github.com/asarubbo/poc/blob/master/00266-libsndfile-heapoverflow-flac_buffer_copy

Timeline:
2017-04-12: bug discovered and reported to upstream
2017-04-12: upstream released a patch
2017-04-29: blog post about the issue

Note:
This bug was found with American Fuzzy Lop.

Permalink:

    libsndfile: heap-based buffer overflow in flac_buffer_copy (flac.c)
===========================================================

(open-)SUSE: https://software.opensuse.org/package/libsndfile

1.0.28 (TW, official repo)
1.0.25 (42.{1,2}, official repo)
Comment 1 Andreas Stieger 2017-04-29 18:14:25 UTC 
assign to maintainer
Comment 2 Mikhail Kasimov 2017-04-30 20:57:26 UTC 
CVE-2017-8363: https://nvd.nist.gov/vuln/detail/CVE-2017-8363
Comment 3 Takashi Iwai 2017-05-02 13:59:41 UTC 
Submitted to FACTORY, SLE12-SP2, SLE11-SP1 and SLE10-SP3.

Reassigning back to security team.
Comment 5 Marcus Meissner 2017-05-09 13:23:08 UTC 
QA REPRODUCER:

install libsndfile-progs and valgrind

valgrind sndfile-convert 00266-libsndfile-heapoverflow-flac_buffer_copy out.wav

should not show read errors
Comment 6 Swamp Workflow Management 2017-05-10 22:10:11 UTC 
SUSE-SU-2017:1236-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946
CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libsndfile-1.0.20-2.18.1
SUSE Linux Enterprise Server 11-SP4 (src):    libsndfile-1.0.20-2.18.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libsndfile-1.0.20-2.18.1
Comment 8 Swamp Workflow Management 2017-05-17 10:04:01 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2017-05-31.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63616
Comment 9 Swamp Workflow Management 2017-05-22 13:11:31 UTC 
SUSE-SU-2017:1367-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946,1038856
CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Server 12-SP2 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Server 12-SP1 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    libsndfile-1.0.25-35.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    libsndfile-1.0.25-35.1
Comment 10 Swamp Workflow Management 2017-05-28 01:10:27 UTC 
openSUSE-SU-2017:1427-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946,1038856
CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365
Sources used:
openSUSE Leap 42.2 (src):    libsndfile-1.0.25-26.6.1, libsndfile-progs-1.0.25-26.6.1
Comment 11 Marcus Meissner 2017-06-15 18:54:35 UTC 
released