Bug 1204642 - (CVE-2022-3598) VUL-0: CVE-2022-3598: tiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c
(CVE-2022-3598)
VUL-0: CVE-2022-3598: tiff: out-of-bounds write in extractContigSamplesShifte...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/346026/
CVSSv3.1:SUSE:CVE-2022-3598:6.5:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-10-24 09:48 UTC by Alexander Bergmann
Modified: 2023-01-16 13:28 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
This is the backport of those commits mentioned in c4 (25.63 KB, patch)
2022-11-17 08:29 UTC, Fridrich Strba
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2022-10-24 09:48:01 UTC
CVE-2022-3598

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in
tools/tiffcrop.c:3604, allowing attackers to cause a denial-of-service via a
crafted tiff file. For users that compile libtiff from sources, the fix is
available with commit cfbb883b.

Upstream commit:
https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3598
https://www.cve.org/CVERecord?id=CVE-2022-3598
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3598.json
https://gitlab.com/libtiff/libtiff/-/issues/435
Comment 2 OBSbugzilla Bot 2022-11-13 23:35:04 UTC
This is an autogenerated message for OBS integration:
This bug (1204642) was mentioned in
https://build.opensuse.org/request/show/1035543 Factory / tiff
Comment 3 OBSbugzilla Bot 2022-11-14 13:35:05 UTC
This is an autogenerated message for OBS integration:
This bug (1204642) was mentioned in
https://build.opensuse.org/request/show/1035628 Factory / tiff
Comment 4 Michael Vetter 2022-11-15 16:08:26 UTC
I have the fixes for CVE-2022-3597 [bsc#1204641] CVE-2022-3626 [bsc#1204644] CVE-2022-3627 [bsc#1204645] CVE-2022-3599 [bsc#1204643] and CVE-2022-3970 [bsc#1205392] in my for SLE12 and SLE15 at https://build.suse.de/project/show/home:mvetter:bv.
All of them are already submitted to Factory.

I will be on vacation and will try to find someone who can work on the last remaining CVE and then make a submission. In case any of the fixed bugs are urgent we could also do a submssion already from my home:mvetter:bv to SLE12/SLE15.

I am/was still working on this bug CVE-2022-3598 [bsc#1204642] which is a little harder since a lot of code changes happened.
Today I also received CVE-2022-3570 [bsc#1205422] which looks like the same as this bug.

Unfortunately I can't finish this bug before my vacation. What I found out so far:

Upstream fix commit is: https://gitlab.com/libtiff/libtiff/-/commit/cfbb883bf6ea7bedcb04177cc4e52d304522fdff

But I think we will also need:
* https://gitlab.com/libtiff/libtiff/-/commit/aac006e57 to check correctly for the buff size
* https://gitlab.com/libtiff/libtiff/-/commit/1f3e801d962b4912d62590fbcfa36c82202a3662 to add the limitMalloc function which enforces memory allocation limit
* https://gitlab.com/libtiff/libtiff/-/commit/40b00cfb3 to add checks to the usage of limitMalloc to prevent a SEGV

In all the mentioned patches we need to adapt the code like:
* uint32_t -> uint32 (same for uint16 etc)
* `%"PRIu16"` -> `%u`
* `%"PRIu32"` -> `%u`
* `%"PRIu64"` -> `%lu`
Comment 5 Fridrich Strba 2022-11-17 08:29:18 UTC
Created attachment 862944 [details]
This is the backport of those commits mentioned in c4
Comment 8 Swamp Workflow Management 2022-12-13 08:27:52 UTC
SUSE-SU-2022:4411-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1204642,1205422
CVE References: CVE-2022-3570,CVE-2022-3598
JIRA References: 
Sources used:
openSUSE Leap Micro 5.3 (src):    tiff-4.0.9-150000.45.22.1
openSUSE Leap Micro 5.2 (src):    tiff-4.0.9-150000.45.22.1
openSUSE Leap 15.4 (src):    tiff-4.0.9-150000.45.22.1
openSUSE Leap 15.3 (src):    tiff-4.0.9-150000.45.22.1
SUSE Manager Server 4.1 (src):    tiff-4.0.9-150000.45.22.1
SUSE Manager Retail Branch Server 4.1 (src):    tiff-4.0.9-150000.45.22.1
SUSE Manager Proxy 4.1 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server for SAP 15 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Server 15-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Micro 5.3 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise Micro 5.2 (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    tiff-4.0.9-150000.45.22.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    tiff-4.0.9-150000.45.22.1
SUSE Enterprise Storage 7 (src):    tiff-4.0.9-150000.45.22.1
SUSE Enterprise Storage 6 (src):    tiff-4.0.9-150000.45.22.1
SUSE CaaS Platform 4.0 (src):    tiff-4.0.9-150000.45.22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2023-01-10 17:21:34 UTC
SUSE-SU-2023:0060-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1204642,1205422
CVE References: CVE-2022-3570,CVE-2022-3598
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    tiff-4.0.9-44.62.1
SUSE Linux Enterprise Server 12-SP5 (src):    tiff-4.0.9-44.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.