Bug 1227424 (CVE-2023-39328)

Summary:	VUL-0: CVE-2023-39328: openjpeg,openjpeg2: denail of service via crafted image file
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	package coldpool <coldpool>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	abergmann, mvetter, pgajdos
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/412863/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-39328:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	Reproducer

Description SMASH SMASH 2024-07-05 07:41:53 UTC

A vulnerability was found in OpenJPEG where an attacker remotely sends malicious pictures to allow the program to run,
which can cause denial of service and exhaust system resources.

References:

https://github.com/uclouvain/openjpeg/issues/1471
https://github.com/uclouvain/openjpeg/pull/1470

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-39328
https://bugzilla.redhat.com/show_bug.cgi?id=2219236

Comment 1 Alexander Bergmann 2024-07-05 08:09:20 UTC

Created attachment 875904 [details]
Reproducer

$ opj_decompress -i CVE-2023-39328.poc -o te.raw

And check memory allocation.

Comment 2 Petr Gajdos 2024-07-11 09:47:32 UTC

opj_decompress is not part of openjpeg 1.5.2. Tried j2k_dump and j2k_to_image,
I was not successful.


:/227424 # j2k_to_image -i CVE-2023-39328.poc.j2k -o te.raw

[ERROR] Prevent buffer overflow (x1: 1291845635, y1: 5)
[ERROR] 0000002a: expected a marker instead of 701
ERROR -> j2k_to_image: failed to decode image!
:/227424 #

Comment 3 Petr Gajdos 2024-07-11 12:57:45 UTC

Tried with openjpeg 2.5.2 (openSUSE.org:home:pgajdos/openjpeg) and it is easily reproducible, indeed:

:/227424 # opj_decompress -i CVE-2023-39328.poc 

===========================================
The extension of this file is incorrect.
FOUND .poc. SHOULD BE .j2k or .jpc or .j2c or .jhc
===========================================
[ERROR] Required parameters are missing
Example: opj_decompress -i image.j2k -o image.pgm
   Help: opj_decompress -h
:/227424 # opj_decompress -i CVE-2023-39328.poc -o te.raw

===========================================
The extension of this file is incorrect.
FOUND .poc. SHOULD BE .j2k or .jpc or .j2c or .jhc
===========================================

[INFO] Start to read j2k main header (0).
[WARNING] Cannot take in charge mct data within multiple MCT records
[INFO] Main header has been correctly decoded.
[INFO] No decoded area parameters, set the decoded area to the whole image
	^C
:/227424 #

Comment 4 Petr Gajdos 2024-07-11 13:01:53 UTC

I think openjpeg 1.5.2 can be affected, still. I guess we should wait for upstream fix to confirm.