Bugzilla – Bug 1160220
VUL-1: CVE-2020-5395: fontforge: use-after-free in SFD_GetFontMetaData in sfd.c
Last modified: 2020-12-04 20:20:52 UTC
CVE-2020-5395 FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-5395 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-5395.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5395 https://github.com/fontforge/fontforge/issues/4084
Tracked SLE12 and SLE15 as affected. The POC can be found attached. To reproduce the issue simply run in GUI mode the following: valgrind fontforge $POC OUTPUT: ==19620== Invalid write of size 8 ==19620== at 0x4C35717: memset (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41857: UnknownInlinedFun (string_fortified.h:71) ==19620== by 0x5E41857: SFD_GetFontMetaData (sfd.c:7826) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so) ==19620== Address 0x117a65b8 is 24 bytes before a block of size 24 alloc'd ==19620== at 0x4C308BF: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41828: SFD_GetFontMetaData (sfd.c:7825) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so) ==19620== ==19620== Invalid write of size 8 ==19620== at 0x4C3571A: memset (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41857: UnknownInlinedFun (string_fortified.h:71) ==19620== by 0x5E41857: SFD_GetFontMetaData (sfd.c:7826) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so) ==19620== Address 0x117a65c0 is 16 bytes before a block of size 24 alloc'd ==19620== at 0x4C308BF: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41828: SFD_GetFontMetaData (sfd.c:7825) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so) ==19620== ==19620== Invalid write of size 8 ==19620== at 0x4C3571E: memset (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41857: UnknownInlinedFun (string_fortified.h:71) ==19620== by 0x5E41857: SFD_GetFontMetaData (sfd.c:7826) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so) ==19620== Address 0x117a65c8 is 8 bytes before a block of size 24 alloc'd ==19620== at 0x4C308BF: realloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so) ==19620== by 0x5E41828: SFD_GetFontMetaData (sfd.c:7825) ==19620== by 0x5E456A0: SFD_GetFont (sfd.c:8320) ==19620== by 0x5E47AF3: SFD_Read (sfd.c:8895) ==19620== by 0x5E606AA: _ReadSplineFont (splinefont.c:1149) ==19620== by 0x5E6117F: LoadSplineFont (splinefont.c:1346) ==19620== by 0x5D1997B: ViewPostScriptFont (fontviewbase.c:1341) ==19620== by 0x5004DBA: fontforge_main (startui.c:1353) ==19620== by 0x55ACF89: (below main) (in /lib64/libc-2.26.so)
Created attachment 827025 [details] POC
SUSE-SU-2020:0118-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160220,1160236 CVE References: CVE-2020-5395,CVE-2020-5496 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): fontforge-20170731-4.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Because the request has been accepted, so I will transfer this bug to our security team. thanks for reporting.
openSUSE-SU-2020:0089-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160220,1160236 CVE References: CVE-2020-5395,CVE-2020-5496 Sources used: openSUSE Leap 15.1 (src): fontforge-20170731-lp151.4.3.1
Created attachment 829598 [details] log of before updating
Created attachment 829599 [details] log of after updating
Hi, there are still a lot of errors after updating while runing "valgrind fontforge test01.sfd". Is this acceptable? Please see the above logs.
(In reply to Liu Shukui from comment #9) > Hi, there are still a lot of errors after updating while runing "valgrind > fontforge test01.sfd". Is this acceptable? > > Please see the above logs. new bug 1164079 is reported.
SUSE-SU-2020:0393-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160220,1160236 CVE References: CVE-2020-5395,CVE-2020-5496 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): fontforge-20170731-11.11.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): fontforge-20170731-11.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
This is an autogenerated message for OBS integration: This bug (1160220) was mentioned in https://build.opensuse.org/request/show/796236 Factory / fontforge
Done
openSUSE-SU-2020:2111-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160220,1178308 CVE References: CVE-2020-25690,CVE-2020-5395 JIRA References: Sources used: openSUSE Leap 15.1 (src): fontforge-20170731-lp151.4.6.1
SUSE-SU-2020:3628-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 1160220,1178308 CVE References: CVE-2020-25690,CVE-2020-5395 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): fontforge-20170731-11.14.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.