Integer Overflow in OpenImageIO Leading to Heap Out-of-Bounds Read

Executive Summary

This vulnerability is an integer overflow in OpenImageIO's Cineon file reader that causes a heap out-of-bounds read. Attackers exploit it by providing a Cineon file with an extremely large declared width, which wraps the size calculation to zero. This results in an undersized scanline buffer, causing UnPackPacked to read past allocated memory and crash the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of OpenImageIO installed on your system. Affected versions are before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1. Use commands like 'openimageio-config --version' or inspect package managers for installed versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can crash applications processing Cineon files, leading to denial-of-service. If exploited, it may allow attackers to execute arbitrary code on the affected system, depending on the application's memory management and security controls.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade OpenImageIO to version 3.0.20.0 or later, 3.1.15.0 or later, or 3.2.0.3-beta1 or later to address the integer overflow issue.
• Apply the official patches from the OpenImageIO repository, particularly those in PR #5568 and commit 07e3c3e, which replace 32-bit arithmetic with 64-bit operations and add safeguards for large scanline sizes.
• Monitor for crashes or memory corruption when processing Cineon or DPX files, as these may indicate exploitation attempts.

Useful 0 Not Useful 0