CVE-2024-40630: 
Linux Debian vulnerability analysis and mitigation

OpenImageIO, a toolset for reading, writing, and manipulating image files, contains a bug in its heif input functionality, specifically in HeifInput::seek_subimage(). The vulnerability was discovered on July 15, 2024, and affects versions prior to 2.5.13.1. The issue has been assigned CVE-2024-40630 and has been addressed in commit 0a2dcb4c (GitHub Commit).

The vulnerability stems from incorrect dimension handling in the HEIF input functionality. The code uses ImageHandle::get_width/height() to obtain image dimensions, which returns untransformed image dimensions from the ispe (Image spatial Extents) metadata. However, these dimensions may not match the actual decoded image's plane sizes, which should be obtained using Image::get_width/height(channel). This mismatch can lead to a heap-based buffer over-read when processing HEIF images. The vulnerability has been assigned a CVSS v3.1 score of 4.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

In the worst case, this vulnerability can lead to information disclosure, particularly affecting programs that directly use the ImageInput APIs. An attacker could craft a malicious HEIF file with forged ispe values to trigger arbitrary out-of-bounds reads, potentially exposing sensitive information from memory (GitHub Advisory).

The vulnerability can be triggered by processing specially crafted HEIF files where the ispe values are forged. For example, modifying a regular HEIC file's ispe dimensions from (1440, 960) to (14400, 9600) can trigger an ASan fault. The exploit can be demonstrated using commands like oiiotool poc.heic -o out.jpeg or any operation that reads the entire image (GitHub Advisory).

The vulnerability has been fixed in OpenImageIO version 2.5.13.1. The fix involves modifying the ImageSpec creation to use Image::get_width/height() methods instead of ImageHandle::get_width/height(). Users are advised to upgrade to version 2.5.13.1 or later. There are no known workarounds for this issue (GitHub Advisory).