Bug 1036789 - (CVE-2017-7475) VUL-0: CVE-2017-7475: cairo: Denial-of-Service Attack due to Logical Problem in Program
(CVE-2017-7475)
VUL-0: CVE-2017-7475: cairo: Denial-of-Service Attack due to Logical Problem ...
Status: REOPENED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Antonio Larrosa
Security Team bot
https://smash.suse.de/issue/184491/
CVSSv2:SUSE:CVE-2017-7475:4.3:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-04-28 12:53 UTC by Marcus Meissner
Modified: 2020-06-18 15:28 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
cairo_report_poc.zip (1.39 MB, application/octet-stream)
2017-04-28 12:54 UTC, Marcus Meissner
Details
cairo_crash_report.pdf (1.45 MB, application/pdf)
2017-05-04 12:30 UTC, Marcus Meissner
Details
1.ttf (5.09 KB, application/octet-stream)
2017-05-04 12:34 UTC, Marcus Meissner
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-04-28 12:53:11 UTC
CVE-2017-7475


## Overview
I and my colleague have found a vulnerability of Cairo-1.15.4 when fuzzing HarfBuzz with AFL. HarBuzz is an OpenType text shaping engine and it contains a tool named hb-view which utilizes Cairo to give a graphical view of text using a font provided by user. This vulnerability is due to logical problem in program, and can cause a Denial-of-Service attack with a crafted font file. 

The attachment is a zip file which includes my detail analysis report and a PoC file. In order to avoid disclosing it before patch is released, I have encrypted it. The developers can communicate with me to get the password.


## Author
name: Jiaqi Peng, Bingchang Liu @VARAS of IIE
email: pjqruc@gmail.com

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7475
http://seclists.org/oss-sec/2017/q2/151
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7475
https://bugs.freedesktop.org/show_bug.cgi?id=100763
Comment 1 Marcus Meissner 2017-04-28 12:54:04 UTC
Created attachment 723146 [details]
cairo_report_poc.zip

cairo_report_poc.zip

from gnome bugzilla
Comment 2 Marcus Meissner 2017-04-28 12:54:52 UTC
(zip archive has a password)
Comment 3 Marcus Meissner 2017-04-28 12:55:52 UTC
hmm, eval pending more knowledge
Comment 6 Marcus Meissner 2017-05-04 12:30:39 UTC
Created attachment 723812 [details]
cairo_crash_report.pdf

cairo_crash_report.pdf  in the zip file
Comment 7 Marcus Meissner 2017-05-04 12:34:54 UTC
Created attachment 723813 [details]
1.ttf

QA REPRODUCER:

(get hb-view from harfbuzz)

hb-view 1.ttf hello
Comment 8 Marcus Meissner 2017-05-04 12:35:18 UTC
from gnome bugzilla: Chris Wilson 2017-05-04 12:09:12 UTC

That was a lot of rigmarole where the simple gdb bt would suffice.

Issue stems from commit 79d975f84bcc32e91db517d71a7312e2e1d653d4
Author: Behdad Esfahbod <behdad@behdad.org>
Date:   Wed Sep 12 17:45:11 2007 -0400

    [cairo-ft-font] Ignore FT_Load_Glyph errors other than out-of-memory
    Same for FT_Render_Glyph.
    
    When the user asks us to render a glyph that is not available in the font,
    it's mostly an unavoidable kind of error for them, as in, they can't
    avoid such a call.  So it's not nice to put cairo_t in an error state and
    refuse any further drawying.
    
    Many PDF files are created using buggy software and cause such glpyh-not-fou
nd
    errors for CID 0 for example.
    
    Eventually we should propagate these kind of errors up and return it from
    the function call causing it, but that needs API change to add return value
    to all text functions, so for now we just ignore these errors.
Comment 9 Marcus Meissner 2017-05-04 13:11:24 UTC
79d975f84bcc32e91db517d71a7312e2e1d653d4 is in 1.5.10
Comment 10 Antonio Larrosa 2017-05-04 17:47:55 UTC
I sent this patch https://bugs.freedesktop.org/show_bug.cgi?id=100763#c6 to upstream for their approval. It's simple and I tested that it fixes the problem in the meantime while better error propagation is implemented in cairo.
Comment 11 Antonio Larrosa 2017-06-07 11:37:17 UTC
There's no response from upstream after a month so I submitted the proposed fix to Factory (http://build.opensuse.org/request/show/501654) and SLE12 SP2 (https://build.suse.de/request/show/133788)
Comment 13 Swamp Workflow Management 2017-06-26 10:12:14 UTC
SUSE-SU-2017:1671-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007255,1036789
CVE References: CVE-2016-9082,CVE-2017-7475
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    cairo-1.15.2-24.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    cairo-1.15.2-24.1
SUSE Linux Enterprise Server 12-SP2 (src):    cairo-1.15.2-24.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    cairo-1.15.2-24.1
Comment 14 Antonio Larrosa 2017-06-27 14:30:29 UTC
The fix was already released so I'm closing the bug report
Comment 15 Antonio Larrosa 2017-06-27 15:50:21 UTC
Reopening and reassigning to security-team so they can close the issue
Comment 16 Swamp Workflow Management 2017-07-06 19:11:00 UTC
openSUSE-SU-2017:1799-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007255,1036789
CVE References: CVE-2016-9082,CVE-2017-7475
Sources used:
openSUSE Leap 42.2 (src):    cairo-1.15.2-5.3.1
Comment 17 Marcus Meissner 2017-10-25 19:31:19 UTC
released
Comment 19 Johannes Segitz 2018-04-17 12:26:17 UTC
Forgot to set maintainer, please see previous comment
Comment 20 Scott Reeves 2018-04-20 23:12:24 UTC
Antonio - can you submit the same fix for SLE11.
Comment 22 Antonio Larrosa 2018-05-22 16:08:04 UTC
I just submitted https://build.suse.de/request/show/165508 to fix this (together with https://build.suse.de/request/show/134478 which was accepted but wasn't released yet)
Comment 24 Swamp Workflow Management 2018-05-28 19:09:43 UTC
SUSE-SU-2018:1453-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007255,1036789,1049092
CVE References: CVE-2016-9082,CVE-2017-7475,CVE-2017-9814
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    cairo-1.8.8-2.3.7.1
SUSE Linux Enterprise Server 11-SP4 (src):    cairo-1.8.8-2.3.7.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    cairo-1.8.8-2.3.7.1