Bug 1196487 - (CVE-2022-24599) VUL-1: CVE-2022-24599: audiofile: memory leak in printinfo.c
(CVE-2022-24599)
VUL-1: CVE-2022-24599: audiofile: memory leak in printinfo.c
Status: CONFIRMED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: E-mail List
Security Team bot
https://smash.suse.de/issue/324633/
CVSSv3.1:SUSE:CVE-2022-24599:4.4:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-02-25 09:52 UTC by Carlos López
Modified: 2022-08-01 13:59 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2022-02-25 09:52:16 UTC
rh#2058371

In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.

https://github.com/mpruett/audiofile/issues/60

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2058371
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24599
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24599
https://github.com/mpruett/audiofile/issues/60
Comment 1 Carlos López 2022-02-25 09:53:01 UTC
Affected:
 - SUSE:SLE-11-SP1:Update
 - SUSE:SLE-12:Update
 - SUSE:SLE-15:Update
 - openSUSE:Factory
Comment 5 Stanislav Brabec 2022-08-01 13:59:57 UTC
The "crafted" file is not as complicated. It is just a AIFF mangled AIFF with a chunk that declares a shorter length than it actually is. As a result, printf() gets an unterminated string and it could swallow part of heap following the string. And the AIFF parser will try to read a random garbage somewhere later.

So I will start with proposed zeroing of the memory and look what is happening there. The goal is simple:
- printf() should always get a NUL terminated string, even if the provided string is not terminated.
- If the AIFF parser gets a random garbage, nothing bad could happen.