OpenEXR CVE-2024-63555: Crash via Empty MultiView EXR File

Vulnerability Overview Vulnerability Name: empty multiView viewFromChannelName file crash Vulnerability Description: A malformed EXR file containing an empty multiView header can cause a crash in OpenEXR's multi-view channel helper path. The function unconditionally returns when parsing a corrupted multiView vector, even if the vector is empty, leading to undefined behavior and a read from the zero page. Severity: Medium (5.9 / 10) CVSS v3 Base Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Affected Versions Affected Versions: 2.1, 3.0, 3.1, 3.2.0-3.2.10, 3.3.0-3.3.12, 3.4.0-3.4.13 Fixed Versions: 3.2.11, 3.3.13, 3.4.14 CVE ID: CVE-2024-63555 CWE ID: CWE-125 Remediation Fixed Versions: Upgrade to version 3.2.11, 3.3.13, or 3.4.14. POC Code ```sh ==200216==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x555555656acb7 in std::__cxx11::basic_string, std::allocator >::basic_strin #1 0x5555556563b3 in std::__cxx11::basic_string, std::allocator >::basic_strin #2 0x5555556563b3 in std::__cxx11::basic_string, std::allocator >::basic_strin #3 0x5555556563b3 in std::map, std::allocator >, Im #4 0x555555656ace8 in _cxx_global_var_init.24 /home/brnzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ #5 0x555555656a0e in GLOBAL_sub_I_ImfCompression.cpp /home/brnzu/openexr/v3.4.13/sources/openexr-main/src/lib/Open #6 0x7ffff7f823b3 in call_init csu/../libc-start.c:145 #7 0x7ffff7f823b3 in _libc_start_main csu/../libc-start.c:347 #8 0x555555656ca4 in _start (/home/brnzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty multiView viewFromCha Uninitialized value was created by a heap allocation #0 0x555555656336 in operator new(unsigned long) /home/brnzu/openexr/v3.4.13/report/32. OpenEXR v3.4.13 empty m #1 0x555555656484 in std::vector, std::allocator > #2 0x555555656484 in std::allocator_traits, std::allocator > #4 0x555555656484 in std::vector, std::allocator > #5 0x555555656484 in std::vector, std::allocator > #6 0x555555656484 in std::vector, std::allocator > #7 0x555555656bcd in std::enable_if, std::allocator >, Im #9 0x555555656bcd in std::map, std::allocator >, Im #10 0x555555659ce8 in _cxx_global_var_init.24 /home/brnzu/openexr/v3.4.13/sources/openexr-main/src/lib/OpenEXR/ #11 0x5555556559cb in GLOBAL_sub_I_ImfCompression.cpp

Goal Reached Thanks to every supporter — we hit 100%!

OpenEXR CVE-2024-63555: Crash via Empty MultiView EXR File

More from this source