OpenEXR Uninitialized Memory Vulnerability in Fuzzing Context

A vulnerability has been identified in OpenEXR versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2. While fuzzing the OpenEXR 'exrcheck' fuzzer, Valgrind detected a conditional branch in the 'generic_unpack' function that relied on uninitialized data. This issue suggests a use of uninitialized memory, which can lead to undefined behavior and potentially cause a crash or denial-of-service condition.

Impact

Exploitation of this vulnerability causes undefined behavior, with a potential to crash the application or create a denial-of-service condition.

Reproduction

The vulnerability can be reproduced using the OpenEXR 'exrcheck' fuzzer, with Valgrind monitoring for memory issues. After building the OpenEXR fuzzers with the OSS-Fuzz infrastructure, the 'exrcheck' fuzzer can be run with a crafted EXR file that triggers the uninitialized memory use. Valgrind will report the conditional jump based on uninitialized values, indicating the vulnerability.

Remediation

Users can upgrade to OpenEXR versions 3.3.6 or 3.4.3, which address this vulnerability.