Bug 1052731 (CVE-2017-12670)

Summary:	VUL-2: CVE-2017-12670: ImageMagick: Missing validation in coders/mat.c, leading to an assertion failure in DestroyImage
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Johannes Segitz <jsegitz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P4 - Low	CC:	meissner, smash_bz
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/189778/
Whiteboard:	CVSSv2:SUSE:CVE-2017-12670:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv3:SUSE:CVE-2017-12670:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVSSv2:NVD:CVE-2017-12670:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv3:RedHat:CVE-2017-12670:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	Reproducer

Description Johannes Segitz 2017-08-08 09:50:25 UTC

Created attachment 735665 [details]
Reproducer

CVE-2017-12670

In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to
an assertion failure in the function DestroyImage in MagickCore/image.c, which
allows attackers to cause a denial of service.

identify assertion_failed_in_DestroyImage

SLE 12 only

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12670
https://github.com/ImageMagick/ImageMagick/issues/610

Comment 1 Marcus Meissner 2017-09-29 07:21:37 UTC

controlled abort, deferable

Comment 2 Petr Gajdos 2018-01-05 11:16:56 UTC

https://github.com/ImageMagick/ImageMagick/commit/ab440f9ea11e0dbefb7a808cbb9441198758b0cb

Comment 3 Petr Gajdos 2018-01-08 08:45:07 UTC

12/ImageMagick

BEFORE

$ identify assertion_failed_in_DestroyImage 
identify: magick/quantum.c:224: DestroyQuantumInfo: Assertion `quantum_info->signature == 0xabacadabUL' failed.
Aborted (core dumped)
$

AFTER

$ identify assertion_failed_in_DestroyImage 
identify: improper image header `assertion_failed_in_DestroyImage' @ error/mat.c/ReadMATImage/1424.
$

Comment 5 Petr Gajdos 2018-01-08 11:02:51 UTC

ImageMagick/11

BEFORE

$ identify assertion_failed_in_DestroyImage 
identify: no decode delegate for this image format `assertion_failed_in_DestroyImage'.
$

AFTER

$ identify assertion_failed_in_DestroyImage 
identify: no decode delegate for this image format `assertion_failed_in_DestroyImage'.
$

Not reproducible with the testcase. Because I am about to update mat.c (almost) to the state of 6.9.9-31, I believe the fix is in if applicable.

Comment 7 Petr Gajdos 2018-01-08 12:48:57 UTC

11/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: Image file or blob does not contain any image data.
gm identify: Request did not return an image.
$

42.x/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: Image file or blob does not contain any image data.
gm identify: Request did not return an image.
$

HG/GraphicsMagick

$ gm identify assertion_failed_in_DestroyImage 
gm identify: No decode delegate for this image format (assertion_failed_in_DestroyImage).
$

Not reproducible.

11/GraphicsMagick: image2 variable is not there at all, not affected
42.x/GraphicsMagick: ThrowImg2MATReaderException(), considering affected
HG/GraphicsMagick: image2 is freed via ThrowImg2MATReaderException(), not affected

Comment 8 Petr Gajdos 2018-01-08 12:49:25 UTC

Will submit for: 12/ImageMagick, 11/ImageMagick and 42.x/GraphicsMagick

Comment 9 Petr Gajdos 2018-01-08 15:26:50 UTC

I believe all fixed.

Comment 10 Swamp Workflow Management 2018-01-08 15:50:30 UTC

This is an autogenerated message for OBS integration:
This bug (1052731) was mentioned in
https://build.opensuse.org/request/show/562562 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/562563 42.2 / GraphicsMagick

Comment 11 Swamp Workflow Management 2018-01-09 13:10:30 UTC

This is an autogenerated message for OBS integration:
This bug (1052731) was mentioned in
https://build.opensuse.org/request/show/562871 42.3 / GraphicsMagick
https://build.opensuse.org/request/show/562872 42.2 / GraphicsMagick

Comment 13 Swamp Workflow Management 2018-01-15 14:08:58 UTC

openSUSE-SU-2018:0087-1: An update that solves 13 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1047044,1049373,1050129,1051412,1052468,1052710,1052720,1052731,1055065,1055434,1058640,1067177,1074123,1074975
CVE References: CVE-2017-10800,CVE-2017-11449,CVE-2017-11532,CVE-2017-12564,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13648,CVE-2017-14326,CVE-2017-16547,CVE-2017-17881,CVE-2017-18022
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-57.1
openSUSE Leap 42.2 (src):    GraphicsMagick-1.3.25-11.60.1

Comment 14 Swamp Workflow Management 2018-01-18 14:09:04 UTC

SUSE-SU-2018:0130-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.26.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.26.1

Comment 15 Swamp Workflow Management 2018-01-18 14:13:51 UTC

SUSE-SU-2018:0132-1: An update that fixes 31 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042948,1047044,1047898,1049373,1050120,1050606,1051412,1051446,1052252,1052468,1052550,1052710,1052720,1052731,1052732,1052771,1055065,1055323,1055434,1055855,1058082,1058640,1059751,1072902,1074122,1074123,1074425,1074610,1074969,1074973,1074975
CVE References: CVE-2017-1000445,CVE-2017-1000476,CVE-2017-10800,CVE-2017-11141,CVE-2017-11449,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-11751,CVE-2017-12430,CVE-2017-12434,CVE-2017-12564,CVE-2017-12642,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14249,CVE-2017-14326,CVE-2017-14533,CVE-2017-17680,CVE-2017-17881,CVE-2017-17882,CVE-2017-18022,CVE-2017-9409,CVE-2018-5246,CVE-2018-5247
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.22.1

Comment 16 Swamp Workflow Management 2018-01-20 17:13:21 UTC

openSUSE-SU-2018:0155-1: An update that fixes 21 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047044,1047898,1050120,1050606,1051446,1052468,1052550,1052710,1052720,1052731,1052732,1055065,1055323,1055434,1055855,1058640,1059751,1074123,1074969,1074973,1074975
CVE References: CVE-2017-10800,CVE-2017-11141,CVE-2017-11529,CVE-2017-11644,CVE-2017-11724,CVE-2017-12434,CVE-2017-12564,CVE-2017-12667,CVE-2017-12670,CVE-2017-12672,CVE-2017-12675,CVE-2017-13060,CVE-2017-13146,CVE-2017-13648,CVE-2017-13658,CVE-2017-14326,CVE-2017-14533,CVE-2017-17881,CVE-2017-18022,CVE-2018-5246,CVE-2018-5247
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-49.1
openSUSE Leap 42.2 (src):    ImageMagick-6.8.8.1-30.21.1

Comment 17 Andreas Stieger 2018-01-31 20:27:53 UTC

releasing for Leap,done