CVE-2019-19624: Out-of-bounds Read in OpenCV

Background

OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing. It is widely used in applications such as robotics, augmented reality, and surveillance systems. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to use OpenCV functionalities in Python applications. However, a vulnerability has been discovered in OpenCV-Python versions before 4.1.1 (OpenCV-Python before 4.1.0.25).

Vulnerability Detail

The vulnerability, identified as CVE-2019-19624, is an out-of-bounds read issue. Specifically, within the calc()/ocl_calc() functions in dis_flow.cpp, the variable 'coarsest_scale' is assumed to be greater than or equal to 'finest_scale'. However, this assumption is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy. This vulnerability can be exploited by an attacker to read sensitive information from the heap, potentially resulting in information disclosure or a denial of service.

pip install --upgrade "opencv-python==5.0.0.93"

pip install --upgrade "opencv-python==4.1.0.25"

Workaround

If updating OpenCV-Python is not immediately feasible, a possible workaround is to avoid processing small images with the affected functions. By ensuring that the images being processed are of sufficient size, the out-of-bounds read issue can be mitigated. Here is an example of how to check and resize an image using the Python Pillow library:

from PIL import Image

def process_image(image_path):
    image = Image.open(image_path)
    width, height = image.size
    if width < 100 or height < 100:
        resized_image = image.resize((100, 100))
        # Process the resized image
    else:
        # Process the original image

process_image('path/to/image.jpg')

Conclusion

In conclusion, the CVE-2019-19624 vulnerability in OpenCV-Python versions before 4.1.1 can lead to an out-of-bounds read issue, potentially resulting in information disclosure or a denial of service. It is crucial to update to the latest version of OpenCV-Python or apply the provided workaround to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for opencv-python →

FAQ