Bugzilla – Bug 1036945
VUL-0: CVE-2017-8363: libsndfile: heap-based buffer overflow in flac_buffer_copy (flac.c)
Last modified: 2018-04-27 22:36:40 UTC
Created attachment 723235 [details] libsndfile-heapoverflow-flac_buffer_copy_reproducer Ref: https://blogs.gentoo.org/ago/2017/04/29/libsndfile-heap-based-buffer-overflow-in-flac_buffer_copy-flac-c/ =========================================================== Description: libsndfile is a C library for reading and writing files containing sampled sound. The complete ASan output of the issue: # sndfile-convert $FILE out.wav ==26966==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000001110 at pc 0x7fd12fe865e6 bp 0x7ffea55e99f0 sp 0x7ffea55e99e8 READ of size 4 at 0x621000001110 thread T0 #0 0x7fd12fe865e5 in flac_buffer_copy /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41 #1 0x7fd12fe86ef4 in flac_read_loop /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:928:3 #2 0x7fd12fe721fb in flac_read_flac2i /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:979:13 #3 0x7fd12fdca3a2 in sf_readf_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/sndfile.c:1835:10 #4 0x514b5d in sfe_copy_data_int /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/common.c:87:16 #5 0x5138d1 in main /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/programs/sndfile-convert.c:340:3 #6 0x7fd12ed6578f in __libc_start_main /tmp/portage/sys-libs/glibc-2.23-r3/work/glibc-2.23/csu/../csu/libc-start.c:289 #7 0x419e18 in _init (/usr/bin/sndfile-convert+0x419e18) 0x621000001110 is located 0 bytes to the right of 4112-byte region [0x621000000100,0x621000001110) allocated by thread T0 here: #0 0x4d94e8 in malloc /tmp/portage/sys-libs/compiler-rt-sanitizers-4.0.0/work/compiler-rt-4.0.0.src/lib/asan/asan_malloc_linux.cc:66 #1 0x7fd12eb2d492 in safe_malloc_muladd2_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/include/share/alloc.h:153 #2 0x7fd12eb2d492 in allocate_output_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:1294 #3 0x7fd12eb2d492 in read_frame_ /tmp/portage/media-libs/flac-1.3.2-r1/work/flac-1.3.2/src/libFLAC/stream_decoder.c:2035 SUMMARY: AddressSanitizer: heap-buffer-overflow /tmp/portage/media-libs/libsndfile-1.0.28/work/libsndfile-1.0.28/src/flac.c:267:41 in flac_buffer_copy Shadow bytes around the buggy address: 0x0c427fff81d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff81f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fff8210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c427fff8220: 00 00[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==26966==ABORTING Affected version: 1.0.28 Fixed version: N/A Commit fix: https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3 Credit: This bug was discovered by Agostino Sarubbo of Gentoo. CVE: N/A Reproducer: https://github.com/asarubbo/poc/blob/master/00266-libsndfile-heapoverflow-flac_buffer_copy Timeline: 2017-04-12: bug discovered and reported to upstream 2017-04-12: upstream released a patch 2017-04-29: blog post about the issue Note: This bug was found with American Fuzzy Lop. Permalink: libsndfile: heap-based buffer overflow in flac_buffer_copy (flac.c) =========================================================== (open-)SUSE: https://software.opensuse.org/package/libsndfile 1.0.28 (TW, official repo) 1.0.25 (42.{1,2}, official repo)
assign to maintainer
CVE-2017-8363: https://nvd.nist.gov/vuln/detail/CVE-2017-8363
Submitted to FACTORY, SLE12-SP2, SLE11-SP1 and SLE10-SP3. Reassigning back to security team.
QA REPRODUCER: install libsndfile-progs and valgrind valgrind sndfile-convert 00266-libsndfile-heapoverflow-flac_buffer_copy out.wav should not show read errors
SUSE-SU-2017:1236-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946 CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): libsndfile-1.0.20-2.18.1 SUSE Linux Enterprise Server 11-SP4 (src): libsndfile-1.0.20-2.18.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): libsndfile-1.0.20-2.18.1
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2017-05-31. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63616
SUSE-SU-2017:1367-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946,1038856 CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Server 12-SP2 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Server 12-SP1 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Desktop 12-SP2 (src): libsndfile-1.0.25-35.1 SUSE Linux Enterprise Desktop 12-SP1 (src): libsndfile-1.0.25-35.1
openSUSE-SU-2017:1427-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1033054,1033914,1033915,1036943,1036944,1036945,1036946,1038856 CVE References: CVE-2017-7585,CVE-2017-7741,CVE-2017-7742,CVE-2017-8361,CVE-2017-8362,CVE-2017-8363,CVE-2017-8365 Sources used: openSUSE Leap 42.2 (src): libsndfile-1.0.25-26.6.1, libsndfile-progs-1.0.25-26.6.1
released