CVE-2017-12599: Out-of-bounds Read in OpenCV

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

OpenCV (Open Source Computer Vision Library) is a popular open-source library used for computer vision and machine learning applications. It provides various functions and algorithms for image and video processing, object detection, and more. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to utilize OpenCV functionalities in Python applications. However, OpenCV versions up to 3.3 (including OpenCV-Python 3.3.0.9) are vulnerable to an out-of-bounds read error.

Vulnerability Detail

The vulnerability (CVE-2017-12599) in OpenCV-Python arises from an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R. This vulnerability can be exploited when reading an image file using the cv::imread function. An attacker can craft a malicious image file that triggers the out-of-bounds read, potentially leading to information disclosure or a denial of service (DoS) attack. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.

pip install --upgrade "opencv-python==3.3.1.11"

Workaround

If updating the package is not immediately feasible, a possible workaround is to validate the image file before passing it to the cv::imread function. This can be done by checking the file size and verifying that it conforms to the expected image format. Here is an example of how to perform this validation in Python:

import os
import cv2

def read_image_safely(file_path):
    if os.path.isfile(file_path) and os.path.getsize(file_path) > 0:
        img = cv2.imread(file_path)
        # Process the image
    else:
        # Handle invalid or empty file
        pass

Conclusion

The vulnerability (CVE-2017-12599) in OpenCV-Python versions up to 3.3.0.9 can be exploited through a crafted image file, leading to an out-of-bounds read error. To mitigate this vulnerability, it is crucial to update the OpenCV-Python package to version 3.3.1.11 or later. Alternatively, developers can implement a workaround by validating image files before processing them. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for opencv-python →

FAQ