OpenEXR v3.4.13 DeepTiledInputFile OOB Read Vulnerability Advisory

漏洞概述 漏洞名称: ILP32 DeepTiledInputFile sample count table decode OOB read 描述: OpenEXR v3.4.13 在处理 ILP32 格式的深 tiled 样本计数解码时存在一个输入验证不足的问题。攻击者可以构造一个特殊的 deep tile 文件，导致 OpenEXRCore 在计算样本计数工作区大小（32-bit size_t）时发生溢出，进而引发 SIGSEGV 崩溃。ASAN 确认了 OpenEXRCore 中的 READ 崩溃，以及公共 C++ 类 DeepTiledInputFile 中的 READ 堆缓冲区溢出。 影响范围 受影响版本: 2.7.0, 3.1, 3.2.0-3.2.10, 3.3.0-3.3.12, 3.4.0-3.4.13 修复版本: 3.2.11, 3.3.13, 3.4.14 修复方案 已修复版本: 3.2.11, 3.3.13, 3.4.14 POC 代码 重现步骤 1. 从 OpenEXR v3.4.13 仓库根目录运行以下命令： 2. 执行以下命令： 3. 运行顶层辅助脚本： 预期结果 original core: 在解码损坏的 deep tiled EXR 时崩溃 UBSAN core: 在解码时崩溃 ASAN C++: 通过 解码时崩溃 完整输出 原始 core-path 输出 完整 ASAN core-path 输出 ```plaintext logs/asan_core.rc: 134 logs/asan_core.stder: AddressSanitizer:DEADLYSIGNAL ================================================================= ==3705280==ERROR: AddressSanitizer: SEGV on unknown address 0x608000000000 (pc 0x567a76cb sp 0x7ffea3720 TO 0x7ffea3720) ==3705280==Hint: address points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page. ==3705280==Hint: pc points to the zero page.

目標達成すべての支援者に感謝 — 100%達成しました！

OpenEXR v3.4.13 DeepTiledInputFile OOB Read Vulnerability Advisory

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

OpenEXR v3.4.13 DeepTiledInputFile OOB Read Vulnerability Advisory

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！