Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1911324 (CVE-2020-35738) - CVE-2020-35738 wavpack: out-of-bounds write in WavpackPackSamples function in pack_utils.c
Summary: CVE-2020-35738 wavpack: out-of-bounds write in WavpackPackSamples function in...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-35738
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: František Hrdina
URL:
Whiteboard:
Depends On: 1911325 1911326 1911383 1911384 1911385
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-12-28 18:05 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-17 10:25 UTC (History)
4 users (show)

Fixed In Version: wavpack 5.4.0
Clone Of:
Environment:
Last Closed: 2021-11-02 18:23:14 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-12-28 18:05:09 UTC 
WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: some third-parties claim that there are later "unofficial" releases through 5.3.2, which are also affected.

Reference:
https://github.com/dbry/WavPack/issues/91
Comment 1 Guilherme de Almeida Suckevicz 2020-12-28 18:05:28 UTC 
Created mingw-wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1911326]


Created wavpack tracking bugs for this issue:

Affects: fedora-all [bug 1911325]
Comment 4 Todd Cullum 2020-12-29 02:53:19 UTC 
Flaw summary:

An attacker who is able to provide a crafted input file to be processed by wavpack audio compressor (e.g. by social engineering a user to attempt to compress a malicious file) could cause a heap buffer overflow -> out-of-bounds write due to unsigned integer wrap in a call to malloc(). The highest impact of the flaw would be to application availability or data integrity.
Comment 6 Todd Cullum 2020-12-29 02:55:25 UTC 
Mitigation:

If using the wavpack utility, this flaw can be mitigated by not running the program on untrusted input files or files from untrusted sources.
Comment 7 Todd Cullum 2021-01-11 17:27:19 UTC 
Upstream commit: https://github.com/dbry/WavPack/commit/89df160596132e3bd666322e1c20b2ebd4b92cd0
Comment 8 Todd Cullum 2021-01-13 00:39:41 UTC 
External References:

https://github.com/dbry/WavPack/releases/tag/5.4.0
Note You need to log in before you can comment on or make changes to this bug.