Advisoriesby IbisLibRaw: Uninitialized memory disclosure via LibRaw_buffer_datastream::read
Summary
Uninitialized memory disclosure can be achieved by parsing a truncated RAW picture.
Severity
High - It is possible to exploit the vulnerable pattern in multiple ways and it may lead to complete memory reconstruction of the target allocation - whose size is controllable through TIFF tags - by an attacker with access to the bitmap result or the parsed metadata.
Proof of Concept
1. Compile LibRaw following the instructions on https://github.com/LibRaw/LibRaw/blob/0.21.2/INSTALL
2. Run the bin/simple_dcraw sample binary with the provided file: bin/simple_dcraw [poc.bin](https://github.com/google/security-research/blob/master/pocs/LibRaw/UninitializedMemorypoc.bin)
Further Analysis
LibRaw supports a wide range of RAW picture formats. In order to do so, it employs a format recognition system based on which TIFF tags are found in the file. Once a format is recognized, the load_raw function pointer - responsible for extracting the raw image from the input file - is populated with the appropriate handler. Such functions commonly use LibRaw_buffer_datastream::read to read from the input buffer, which is semantically equivalent to libc’s [fread](https://linux.die.net/man/3/fread). A number of load_raw functions [1] do not check the return value of LibRaw_buffer_datastream::read or if the end of input has been reached. This leaves part of the raw image...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| LibRaw Product | all versions | No fix yet |
Details and references
### Summary Uninitialized memory disclosure can be achieved by parsing a truncated RAW picture. ### Severity High - It is possible to exploit the vulnerable pattern in multiple ways and it may lead to complete memory reconstruction of the target allocation - whose size is controllable through TIFF tags - by an attacker with access to the bitmap result or the parsed metadata. ### Proof of Concept 1. Compile LibRaw following the instructions on https://github.com/LibRaw/LibRaw/blob/0.21.2/INSTALL 2. Run the `bin/simple_dcraw` sample binary with the provided file: bin/simple_dcraw [poc.bin](https://github.com/google/security-research/blob/master/pocs/LibRaw/UninitializedMemorypoc.bin) ### Further Analysis LibRaw supports a wide range of RAW picture formats. In order to do so, it employs a format recognition system based on which TIFF tags are found in the file. Once a format is recognized, the `load_raw` function pointer - responsible for extracting the raw image from the input file - is populated with the appropriate handler. Such functions commonly use `LibRaw_buffer_datastream::read` to read from the input buffer, which is semantically equivalent to libc’s [fread](https://linux.die.net/man/3/fread). A number of `load_raw` functions [1] do not check the return value of `LibRaw_buffer_datastream::read` or if the end of input has been reached. This leaves part of the raw image backing buffer uninitialized and allows an attacker to reconstruct portions of heap memory by analyzing the bitmap result. Similarly, some metadata [2] is parsed via the same API and may allow an attacker with access to the parsed metadata to directly read uninitialized heap memory. These functions are affected by the vulnerable pattern: [1] - `LibRaw::nikon_coolscan_load_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_libraw_dcrdefs.cpp#L144 (exploited in the proof of concept below) - `LibRaw::sony_arw2_load_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_dcraw.cpp#L1479 - `LibRaw::rollei_load_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_dcraw.cpp#L990 - `LibRaw::unpack_thumb`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/unpack_thumb.cpp#L136 - `LibRaw::nikon_14bit_load_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_libraw.cpp#L203 - `LibRaw::fuji_14bit_load_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_libraw.cpp#L223 - `LibRaw::nikon_load_padded_packed_raw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_libraw.cpp#L254 - `LibRaw::nikon_load_sraw`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_libraw.cpp#L566 - `LibRaw::pana_data`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/decoders/decoders_dcraw.cpp#L1102 [2] - `LibRaw::parse_tiff_ifd`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/metadata/tiff.cpp#L589 - `LibRaw::parseSonyMakernotes`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/metadata/sony.cpp#L1106 - `LibRaw::PentaxLensInfo`: https://github.com/LibRaw/LibRaw/blob/0.21.2/src/metadata/pentax.cpp#L140 ### Timeline **Date reported**: 09/13/2024 **Date fixed**: 09/18/2024 **Date disclosed**: 10/18/2024
- Severity from
- GitHub (reviewed advisory)