Imagemagick: heap-use-after-free in MagickCore/resize.c and double-free in RelinquishAlignedMemory of MagickCore/memory.c

[SuhwanSong]

Prerequisites

• [x] I have written a descriptive issue title
• [x] I have verified that I am using the latest version of ImageMagick
• [x] I have searched open and closed issues to ensure it has not already been reported

Description

There are a heap-use-after-free(sometimes heap-buffer-overflow) vulnerability in MagickCore/resize.c:2604:28 in .omp_outlined._debug__.69 and a double-free bug in RelinquishAlignedMemory MagickCore/memory.c:1037:3 with the same input.

For each run, different bugs are triggered so please run the command for several times.

related: #1344

Steps to Reproduce

• ImageMagick version:
  Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10

• Environment (Operating system, version and so on):
  Description: Ubuntu 18.04.1 LTS
  Release: 18.04
  Codename: bionic

• Additional information: CC=clang-7 CXX=clang++-7

[dlemstra]

The issues that you have reported all seem to be related to omp. Maybe you could try upgrading that library to determine if that fixes the issue? I am really wondering if this is an ImageMagick issue.

[SuhwanSong]

The issues that you have reported all seem to be related to omp. Maybe you could try upgrading that library to determine if that fixes the issue? I am really wondering if this is an ImageMagick issue.

@dlemstra
I followed this command sudo apt-get install libomp-dev and libomp-dev 5.0.1-1 (latest version) is already installed. (and also I run apt-get update and upgrade) .
Then I recompiled ImageMagick with clang-7 and clang++-7 version and executed all commands that I reported and found there're still vulnerabilities in the program.

[urban-warrior]

Build ImageMagick as follows:

./configure --disable-openmp
make install

Does that resolve the problem?

[SuhwanSong]

@urban-warrior
I followed your comment to reinstall it and re-ran.
I got this result from ASAN and all that I reported have memory vulnerabilities.

==27142==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 36976 byte(s) in 9 object(s) allocated from:
    #0 0x4e5397 in __interceptor_malloc (install/bin/magick+0x4e5397)
    #1 0x7f01aab3e376 in AcquireMagickMemory MagickCore/memory.c:478:10
    #2 0x7f01aab3e3df in AcquireQuantumMemory MagickCore/memory.c:551:10
    #3 0x7f01aaccee67 in AcquireString MagickCore/string.c:142:24
    #4 0x7f01aaccfa11 in CloneString MagickCore/string.c:300:20
    #5 0x7f01aa9d6e8a in CloneDrawInfo MagickCore/draw.c:310:12
    #6 0x7f01aa82b3db in AnnotateImage MagickCore/annotate.c:267:12
    #7 0x7f01aab4d17a in MontageImageList MagickCore/montage.c:842:22
    #8 0x7f01aab472e1 in MontageImages MagickCore/montage.c:316:17
    #9 0x7f01aaa383c4 in PreviewImage MagickCore/effect.c:2747:17
    #10 0x7f01aa2ad841 in CLISimpleOperatorImage MagickWand/operation.c:2964:21
    #11 0x7f01aa29dc78 in CLISimpleOperatorImages MagickWand/operation.c:3685:12
    #12 0x7f01aa2c3305 in CLIOption MagickWand/operation.c:5270:16
    #13 0x7f01aa104a99 in ProcessCommandOptions MagickWand/magick-cli.c:477:7
    #14 0x7f01aa105d0a in MagickImageCommand MagickWand/magick-cli.c:796:5
    #15 0x7f01aa14fba1 in MagickCommandGenesis MagickWand/mogrify.c:185:14
    #16 0x526f95 in MagickMain utilities/magick.c:149:10
    #17 0x5268e1 in main utilities/magick.c:180:10
    #18 0x7f01a4bc6b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

SUMMARY: AddressSanitizer: 36976 byte(s) leaked in 9 allocation(s).

[urban-warrior]

Can you check your magick-command-line? We're trying to reproduce the problem you reported but a copy/paste of your command returns an exception.

[SuhwanSong]

@urban-warrior
I copied/pasted my command and the program returns unrecognized option exception in my case too.
The reason I reported this issue is that it results memory leak with ASAN even though the program returns exception.

Is every issue I've reported impossible to produce memory bugs?

exception:
magick: unrecognized option -stretch' at CLI arg 23 @ error/operation.c/CLISimpleOperatorImage/3420.

[urban-warrior]

Thanks for the problem report. We can reproduce it and will have a patch to fix it in GIT master branch @ https://github.com/ImageMagick/ImageMagick later today. The patch will be available in the beta releases of ImageMagick @ http://www.imagemagick.org/download/beta/ by sometime tomorrow.

[nohmask]

This was assigned CVE-2019-13301.

[Kirill200889]

Hello, NVD says 7.0.8-50 is the vulnerable version but it seems like 7.0.8-50 already patched and contains the commit. Can you please clarify what is fixed version and what the vulnerable versions? Thanks.

[dlemstra]

This was fixed in 7.0.8-50. We have seen this happen with a lot of other CVE's. I suspect this is happening because we increase the version number before we do the release.

[jdelta-RBS]

Yeah what they're doing is looking at the researcher's "ImageMagick Version: ImageMagick 7.0.8-50 Q16 x86_64 2019-06-10" and just plugging in 7.0.8-50, rather than verifying the current release.