1279413 - (CVE-2014-9766) pixman: integer overflow in create_bits function

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[Huzaifa Sidhpurwala]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:46.0) Gecko/20100101 Firefox/46.0
Build ID: 20160503092137

Steps to reproduce:

CVE-2014-9766 is related to pixman: integer overflow in create_bits function, which Firefox seems to embed.

Details at:
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.

http://lists.freedesktop.org/archives/pixman/2014-April/003244.html

I find similar code in the version of pixman embedded in firefox. But i dont really have the skills to figure out, if Firefox is indeed affected.

Would appreciate if you could look, thanks!

Comment 1

[:Gijs (he/him)]

Jeff, looks like the fix is from pixman 0.32.6, and we're running 0.29.2 on nightly. Is that right?

Comment 2

[Huzaifa Sidhpurwala]

dveditz,

This is a code execution bug, remote ACE for firefox, and its already public, can you accelerate this a bit?

Thanks!

Comment 3

[:Gijs (he/him)]

ni for comment #2

Comment 4

[Daniel Veditz [:dveditz]]

(In reply to Huzaifa Sidhpurwala from comment #2)
> This is a code execution bug, remote ACE for firefox,

Is it? Gecko imposes image size limits that should kick in before this code is called. Without a testcase this is still an investigatory bug (though I agree we ought to update our libraries)

Comment 5

[Huzaifa Sidhpurwala]

You could be right, as i said, i have not investigated this from a mozilla pov, but am generally worried about getting it fixed there.

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/330fb1898594

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Jeff, could you fill the uplift requests to aurora, beta & esr? Thanks

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Just caught this - no sec rating but it has already landed.  Milan can you request uplift ?

Comment 9

[Milan Sreckovic [:milan] (needinfo for best results)]

Attachment: The patch that landed (from upstreamed https://lists.freedesktop.org/archives/pixman/2014-April/003244.html)

Creating the patch that already landed, so that we can request uplift.

Approval Request Comment
[Feature/regressing bug #]: In upstream pixman at our version 0.29.2, fixed by 0.32.6 in 2014.
[User impact if declined]: We don't know the attack vector, but the description of the upstream problem is:
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Comment on attachment 8771561 [details] [diff] [review]
The patch that landed (from upstreamed https://lists.freedesktop.org/archives/pixman/2014-April/003244.html)

Milan, Jeff, what about ESR45? Thanks

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/7827e7019cb9

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-beta/rev/adfa3c5930cf

Comment 13

[Milan Sreckovic [:milan] (needinfo for best results)]

Comment on attachment 8771561 [details] [diff] [review]
The patch that landed (from upstreamed https://lists.freedesktop.org/archives/pixman/2014-April/003244.html)

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:

This is somewhat difficult without the security rating.  The description is above, and the fix is simple enough that even without a known attack vector, it would be good to get it into 45esr.

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 8771561 [details] [diff] [review]
The patch that landed (from upstreamed https://lists.freedesktop.org/archives/pixman/2014-April/003244.html)

We should take this on all the branches, a=dveditz for ESR-45

Comment 15

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-esr45/rev/13cb36dee2c5

Comment 16

[Huzaifa Sidhpurwala]

Is there going to be an advisory for this?

Comment 17

[Al Billings [:abillings - ex-MoCo]]

No, there is not (hence the minus tags for the released in the whiteboard). It isn't clear that Firefox was actually affected by this in practice.