Bug 1027025 - (CVE-2017-6314) VUL-1: CVE-2017-6314: gdk-pixbuf: Infinite loop in io-tiff.c
(CVE-2017-6314)
VUL-1: CVE-2017-6314: gdk-pixbuf: Infinite loop in io-tiff.c
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/180941/
CVSSv2:SUSE:CVE-2017-6314:5.0:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-02-27 07:30 UTC by Marcus Meissner
Modified: 2022-01-23 14:33 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-02-27 07:30:33 UTC
http://seclists.org/oss-sec/2017/q1/466

2. Infinite loop in io-tiff.c [2]
---------------------------------
This loader for tiff images will try and allocate a buffer as big as size
given to it. It calls the make_available_at_least function to do that.
The problem is in the function itself (from line 499):

if (need_alloc > context->allocated) {
    guint new_size = 1;
    while (new_size < need_alloc)
        new_size *= 2;
...

new_size starts with 1 and multiplies until it is larger or equal to
need_alloc. If need_alloc is larger than 2^31, new_size will become 2^31
and multiply itself in 2, and become 0. This would lead to an infinite loop.

CVE-2017-6314
Comment 1 Marcus Meissner 2017-02-27 07:34:20 UTC
https://bugzilla.gnome.org/show_bug.cgi?id=779020
Comment 2 Swamp Workflow Management 2017-02-27 23:00:51 UTC
bugbot adjusting priority
Comment 3 Marcus Meissner 2017-02-28 16:59:55 UTC
no testcase or patch in gnome bug so far.

A check against INT_MAX or similar might be useful.
Comment 4 Scott Reeves 2017-03-03 22:40:02 UTC
Hi Yifan, can you have someone on your team take this.
Comment 5 Yifan Jiang 2017-03-06 02:46:44 UTC
Hi Xiaoguang,

Would you help to take care of this, thank you!
Comment 10 Swamp Workflow Management 2017-09-06 19:07:51 UTC
SUSE-SU-2017:2381-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027024,1027025,1027026,1048289,1048544,1049877
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Server 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    gdk-pixbuf-2.34.0-19.5.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    gdk-pixbuf-2.34.0-19.5.1
Comment 11 Swamp Workflow Management 2017-09-08 19:07:37 UTC
openSUSE-SU-2017:2393-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1027024,1027025,1027026,1048289,1048544,1049877
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
openSUSE Leap 42.3 (src):    gdk-pixbuf-2.34.0-10.1
openSUSE Leap 42.2 (src):    gdk-pixbuf-2.34.0-7.3.1
Comment 13 Hans Petter Jansson 2018-04-30 15:19:00 UTC
Closing as fixed.
Comment 19 Swamp Workflow Management 2018-08-21 16:10:22 UTC
SUSE-SU-2018:2470-1: An update that solves 5 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1027024,1027025,1027026,1039465,1048289,1048544
CVE References: CVE-2017-2862,CVE-2017-2870,CVE-2017-6312,CVE-2017-6313,CVE-2017-6314
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
SUSE Linux Enterprise Server 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    gtk2-2.18.9-0.45.8.1
Comment 20 Marcus Meissner 2018-10-10 13:52:25 UTC
we are still tracking this unfixed for SLE-11 gdk-pixbuf
Comment 21 Michael Gorse 2019-08-15 21:53:57 UTC
The relevant code isn't in SLE-11 gdk-pixbuf. In newer versions of gdk-pixbuf/gtk2, make_available_at_least is called by gdk_pixbuf_tiff_image_load_increment, but, in SLE-11 gdk-pixbuf, that function just calls fwrite and doesn't do any memory allocation.
Comment 23 Marcus Meissner 2022-01-23 14:33:03 UTC
done