First Last Prev Next    This bug is not in your last search results.
Bug 1040025 - (CVE-2017-9098) VUL-0: CVE-2017-9098: GraphicsMagick,ImageMagick: coders/rle.c. uninitialized memory usage in the ReadRLEImage RLE decoder function
(CVE-2017-9098)
VUL-0: CVE-2017-9098: GraphicsMagick,ImageMagick: coders/rle.c. uninitialized...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/185558/
CVSSv2:SUSE:CVE-2017-9098:4.3:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-05-20 08:27 UTC by Marcus Meissner
Modified: 2017-08-25 12:43 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
CVE-2017-9098.rle (18 bytes, application/octet-stream)
2017-05-20 09:30 UTC, Marcus Meissner 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-05-20 08:27:03 UTC 
CVE-2017-9098

ImageMagick before 7.0.5-2 uses uninitialized memory in the RLE decoder,
allowing an attacker to leak sensitive information from process memory space, as
demonstrated by remote attacks against ImageMagick code in a long-running server
process that converts image data on behalf of multiple users. This is caused by
a missing initialization step in the ReadRLEImage function in coders/rle.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9098
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9098.html
http://www.cvedetails.com/cve/CVE-2017-9098/
https://scarybeastsecurity.blogspot.com/2017/05/bleed-continues-18-byte-file-14k-bounty.html
https://github.com/ImageMagick/ImageMagick/commit/1c358ffe0049f768dd49a8a889c1cbf99ac9849b
Comment 1 Marcus Meissner 2017-05-20 09:30:41 UTC 
Created attachment 725789 [details]
CVE-2017-9098.rle

QA REPRODUCER:

valgrind convert CVE-2017-9098.rle foo.jpg

shjould not report uninitialized memory reads
Comment 2 Marcus Meissner 2017-05-20 09:37:52 UTC 
affects SLE11 and SLE12 GM/IM

Factory GraphicsMagick might be fixed already, also ImageMagick in factory seems not to trigger valgrind
Comment 3 Petr Gajdos 2017-05-22 10:25:21 UTC 
Tested with 12/ImageMagick:

$ valgrind convert CVE-2017-9098.rle foo.jpg
[..]
==9425== Thread 6:
==9425== Conditional jump or move depends on uninitialised value(s)
==9425==    at 0x4F46C90: PushColormapIndex (image.c:3397)
==9425==    by 0x4F46C90: SyncImage._omp_fn.4 (image.c:3457)
==9425==    by 0x716ABE9: ??? (in /usr/lib64/libgomp.so.1.0.0)
==9425==    by 0x55FC0A3: start_thread (in /lib64/libpthread-2.19.so)
==9425==    by 0x58F602C: clone (in /lib64/libc-2.19.so)
==9425== 
==9425== Use of uninitialised value of size 8
==9425==    at 0x4F46C68: SyncImage._omp_fn.4 (image.c:3460)
==9425==    by 0x716ABE9: ??? (in /usr/lib64/libgomp.so.1.0.0)
==9425==    by 0x55FC0A3: start_thread (in /lib64/libpthread-2.19.so)
==9425==    by 0x58F602C: clone (in /lib64/libc-2.19.so)
==9425== 
==9425== Thread 1:
==9425== Conditional jump or move depends on uninitialised value(s)
==9425==    at 0x4F46C90: PushColormapIndex (image.c:3397)
==9425==    by 0x4F46C90: SyncImage._omp_fn.4 (image.c:3457)
==9425==    by 0x4F4B088: SyncImage (image.c:3429)
==9425==    by 0x8418B2A: ReadRLEImage (rle.c:564)
==9425==    by 0x4EBF2BA: ReadImage (constitute.c:601)
==9425==    by 0x4EC037A: ReadImages (constitute.c:907)
==9425==    by 0x5319BAE: ConvertImageCommand (convert.c:617)
==9425==    by 0x5385C72: MagickCommandGenesis (mogrify.c:166)
==9425==    by 0x400906: ConvertMain (convert.c:81)
==9425==    by 0x400906: main (convert.c:92)
==9425== 
==9425== Use of uninitialised value of size 8
==9425==    at 0x4F46C68: SyncImage._omp_fn.4 (image.c:3460)
==9425==    by 0x4F4B088: SyncImage (image.c:3429)
==9425==    by 0x8418B2A: ReadRLEImage (rle.c:564)
==9425==    by 0x4EBF2BA: ReadImage (constitute.c:601)
==9425==    by 0x4EC037A: ReadImages (constitute.c:907)
==9425==    by 0x5319BAE: ConvertImageCommand (convert.c:617)
==9425==    by 0x5385C72: MagickCommandGenesis (mogrify.c:166)
==9425==    by 0x400906: ConvertMain (convert.c:81)
==9425==    by 0x400906: main (convert.c:92)
==9425== 
==9425== 
[..]
==9425== ERROR SUMMARY: 2097152 errors from 4 contexts (suppressed: 0 from 0)
$

AFTER

$ valgrind convert CVE-2017-9098.rle foo.jpg
[..]
==22584== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
$

Similarly for 11/ImageMagick, even exactly same number of errors. I do not get any such valgrind error for 11/ImageMagick and 42.2/GraphicsMagick. 42.2/GraphicsMagick contains memset() added by

http://hg.code.sf.net/p/graphicsmagick/code/diff/0a5b75e019b6/coders/rle.c

though, so considering 11/GraphicsMagick affected, too.

Summary, basically see comment 2.
Comment 4 Petr Gajdos 2017-05-22 10:36:14 UTC 
Packages submitted.
Comment 8 Swamp Workflow Management 2017-06-06 16:14:17 UTC 
SUSE-SU-2017:1489-1: An update that fixes 27 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1028075,1033091,1034870,1034872,1034876,1036976,1036977,1036978,1036980,1036981,1036982,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1036991,1037527,1038000,1040025,1040303,1040304,1040306,1040332
CVE References: CVE-2017-6502,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8343,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8347,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8356,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-70.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-70.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-70.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-70.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-70.1
Comment 10 Swamp Workflow Management 2017-06-14 13:14:13 UTC 
openSUSE-SU-2017:1560-1: An update that fixes 27 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1028075,1033091,1034870,1034872,1034876,1036976,1036977,1036978,1036980,1036981,1036982,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1036991,1037527,1038000,1040025,1040303,1040304,1040306,1040332
CVE References: CVE-2017-6502,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8343,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8347,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8356,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144
Sources used:
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.3.1
Comment 11 Swamp Workflow Management 2017-06-19 10:12:48 UTC 
SUSE-SU-2017:1599-1: An update that fixes 25 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033091,1034870,1034872,1034876,1036976,1036978,1036980,1036981,1036983,1036984,1036985,1036986,1036987,1036988,1036989,1036990,1037527,1038000,1040025,1040303,1040304,1040306,1040332
CVE References: CVE-2014-9846,CVE-2016-10050,CVE-2017-7606,CVE-2017-7941,CVE-2017-7942,CVE-2017-7943,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8348,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8354,CVE-2017-8355,CVE-2017-8357,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9141,CVE-2017-9142,CVE-2017-9143,CVE-2017-9144
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.77.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.77.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.77.1
Comment 12 Swamp Workflow Management 2017-06-19 13:12:01 UTC 
SUSE-SU-2017:1600-1: An update that fixes 17 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033091,1034876,1036978,1036980,1036981,1036984,1036985,1036986,1036987,1036988,1036990,1037527,1038000,1040025,1040304,1040332,984144
CVE References: CVE-2014-9847,CVE-2017-7606,CVE-2017-7941,CVE-2017-8344,CVE-2017-8345,CVE-2017-8346,CVE-2017-8349,CVE-2017-8350,CVE-2017-8351,CVE-2017-8352,CVE-2017-8353,CVE-2017-8355,CVE-2017-8765,CVE-2017-8830,CVE-2017-9098,CVE-2017-9142,CVE-2017-9144
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.77.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.77.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.77.1
Comment 13 Marcus Meissner 2017-08-25 12:43:56 UTC 
released
First Last Prev Next    This bug is not in your last search results.