[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5EDB84F4B23F5B4DB6500A89258280E0BB6286@EX02.corp.qihoo.net>
Date: Wed, 15 Jun 2016 02:33:54 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-5320: libtiff 4.0.6 rgb2ycbcr: command excution
Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: command excution
Vendor URL: http://www.remotesensing.org/libtiff/
CVE ID: CVE-2016-5320
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
Introduction
=======
It was always corrupted when I use rgb2ycbcr command followed by a crafted TIFF image. The vulnerability of out-of-bound writes is in PixarLogDecode () function in tif_pixarlog.c, which cause the function pointer of vgetparent to be coverd with any data, command execution could be possible.
Tested system version:
fedora23 64bit
CentOS Linux release 7.1.1503 64bit
command :
./rgb2ycbcr poc.tif tmpout.tif
Here is the stack info:
gdb –args ./rgb2ycbcr poc.tif tmpout.tif
--- ---
Program received signal SIGSEGV, Segmentation fault.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[registers]--
$rax 0x5e5e5e5e5e5e5e5e $rbx 0x0000000000608560 $rcx 0x0000000000608560 $rdx 0x00007fffffffd870 $rsp 0x00007fffffffd7e0 $rbp 0x00007fffffffd810 $rsi 0x000000000000010a
$rdi 0x0000000000608560 $rip 0x00007ffff7badecb $r8 0x00007ffff7b6be8e $r9 0x0000000000000001 $r10 0x00007fffffffd6d0 $r11 0x00007ffff7b685ab $r12 0x0000000000000020
$r13 0x0000000000000200 $r14 0x0000000000607010 $r15 0x0000000000000000 $cs 0x0000000000000033 $ss 0x000000000000002b $ds 0x0000000000000000 $es 0x0000000000000000
$fs 0x0000000000000000 $gs 0x0000000000000000 $eflags [ CF AF SF IF RF ]
Flags: [ CARRY parity ADJUST zero SIGN trap INTERRUPT direction overflow RESUME virtualx86 identification ]
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[stack]--
0x00007fffffffd7e0|+0x00: 0x0 <- $sp
0x00007fffffffd7e8|+0x08: 0x00007fffffffd870 -> 0x3000000010
0x00007fffffffd7f0|+0x10: 0x10a00000000
0x00007fffffffd7f8|+0x18: 0x0000000000608560 -> 0x0000000000608998 -> "PredictorVGetField.tif"
0x00007fffffffd800|+0x20: 0x10600000000
0x00007fffffffd808|+0x28: 0x0000000000609160 -> "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^[...]"
0x00007fffffffd810|+0x30: 0x00007fffffffd850 -> 0x00007fffffffd940 -> 0x10
0x00007fffffffd818|+0x38: 0x00007ffff7b6a880 -> <TIFFVGetField+149>: jmp 0x7ffff7b6a887 <TIFFVGetField+156>
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[code:i386:x86-64]--
0x7ffff7badebd <PredictorVGetField+224> mov rdx,QWORD PTR [rbp-0x28]
0x7ffff7badec1 <PredictorVGetField+228> mov esi,DWORD PTR [rbp-0x1c]
0x7ffff7badec4 <PredictorVGetField+231> mov rcx,QWORD PTR [rbp-0x18]
0x7ffff7badec8 <PredictorVGetField+235> mov rdi,rcx
0x7ffff7badecb <PredictorVGetField+238> call rax <- $pc
0x7ffff7badecd <PredictorVGetField+240> leave
0x7ffff7badece <PredictorVGetField+241> ret
0x7ffff7badecf <PredictorPrintDir> push rbp
0x7ffff7baded0 <PredictorPrintDir+1> mov rbp,rsp
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[source:tif_predict.c+706]--
702 case TIFFTAG_PREDICTOR:
703 *va_arg(ap, uint16*) = (uint16)sp->predictor;
704 break;
705 default:
706 return (*sp->vgetparent)(tif, tag, ap); <- $pc ; tif=0x00007fffffffd7f8 -> [...] -> "PredictorVGetField.tif", ap=0x00007fffffffd7e8 -> [...] -> 0x3000000010, sp=0x00007fffffffd808 -> [...] -> "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^[...]"
707 }
708 return 1;
709 }
710
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[trace]--
#0 0x00007ffff7badecb in PredictorVGetField (tif=0x608560, tag=266, ap=0x7fffffffd870) at tif_predict.c:706
#1 0x00007ffff7b6a880 in TIFFVGetField (tif=0x608560, tag=266, ap=0x7fffffffd870) at tif_dir.c:1174
#2 0x00007ffff7b6a7dd in TIFFGetField (tif=0x608560, tag=266) at tif_dir.c:1158
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
0x00007ffff7badecb in PredictorVGetField (tif=0x608560, tag=266, ap=0x7fffffffd870) at tif_predict.c:706
706 return (*sp->vgetparent)(tif, tag, ap);
gef> bt
#0 0x00007ffff7badecb in PredictorVGetField (tif=0x608560, tag=266, ap=0x7fffffffd870) at tif_predict.c:706
#1 0x00007ffff7b6a880 in TIFFVGetField (tif=0x608560, tag=266, ap=0x7fffffffd870) at tif_dir.c:1174
#2 0x00007ffff7b6a7dd in TIFFGetField (tif=0x608560, tag=266) at tif_dir.c:1158
#3 0x0000000000403700 in tiffcvt (in=in@...ry=0x608560, out=out@...ry=0x607010) at rgb2ycbcr.c:328
#4 0x000000000040183b in main (argc=3, argv=0x7fffffffe328) at rgb2ycbcr.c:127
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
