Out-of-Bounds Read Vulnerability in OpenCV: CVE-2019-19624
Summary
CVE-2019-19624: An out-of-bounds read was discovered in OpenCV before 4.1.1. Affects opencv across 3 version ranges.
< 4.1.2+dfsg-3
< 0915b7eaddba3c06d83e201c9a7595e73801f417
< d1615ba11a93062b1429fce9f0f638d1572d3418
Fixed in 4.1.2+dfsg-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It includes several hundred algorithms for image processing, machine learning, and computer vision tasks. The library is widely used in various applications, from robotics to augmented reality. However, prior to version 4.1.1, OpenCV was susceptible to an out-of-bounds read vulnerability, which could lead to potential data leaks or crashes when processing small images.
Vulnerability Detail
An out-of-bounds read was discovered in OpenCV before version 4.1.1. The vulnerability arises from the assumption that the variable 'coarsest_scale' is always greater than or equal to 'finest_scale' within the calc() and ocl_calc() functions in dis_flow.cpp. This assumption fails for small images, resulting in an out-of-bounds read of the heap-allocated arrays Ux and Uy. Such vulnerabilities can lead to unexpected behavior, including crashes or the exposure of sensitive data.
How To Fix
Minimum fixed version
4.1.2+dfsg-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opencvTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing input validation to ensure that images processed by the calc() and ocl_calc() functions are of sufficient size to avoid triggering the out-of-bounds read. This can be done by checking the dimensions of the input images before processing them.
Conclusion
CVE-2019-19624 represents a significant vulnerability in OpenCV that can lead to serious consequences if not addressed. Users are strongly encouraged to upgrade to the latest version to mitigate risks associated with this out-of-bounds read issue. Implementing proper input validation can serve as a temporary workaround until an upgrade is feasible.
See every vulnerability recorded for opencv →
FAQ
CVE-2019-19624 is a vulnerability in OpenCV that allows for an out-of-bounds read due to incorrect assumptions about image scaling.
Exploiting this vulnerability may lead to crashes or data leaks, compromising the integrity and confidentiality of your application.
OpenCV versions prior to 4.1.1 are affected by this vulnerability.
The CVSS score for CVE-2019-19624 is 6.5, indicating a medium severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
