CVE-2022-0544

An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.

References

Affected packages

Git / github.com/blender/blender

Affected ranges

Type

GIT

Repo

https://github.com/blender/blender

Events

Introduced

Fixed

86c526d2c733e2c3de0222b87cee14bc925ac308

Introduced

0330d1af29c067cf309e4798f5259e01a8c3c668

Fixed

09da7f489ad951eff5fc42f97a8079fafce12a89

Introduced

f1cca3055776be50f59dd4fb6de3018afb53d52c

Fixed

c77597cd0e15f9d7b6f963593b545cc94950eb8d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.83.19"
        },
        {
            "introduced": "2.90.0"
        },
        {
            "fixed": "2.93.8"
        },
        {
            "introduced": "3.0"
        },
        {
            "fixed": "3.1"
        }
    ]
}

Affected versions

v3.*

v3.0.0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    }
]

vanir_signatures

[
    {
        "signature_version": "v1",
        "target": {
            "function": "sculpt_undo_geometry_restore_data",
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c"
        },
        "digest": {
            "length": 979.0,
            "function_hash": "161412462493676655162831838872195101415"
        },
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "signature_type": "Function",
        "id": "CVE-2022-0544-99b905fa",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "source/blender/editors/sculpt_paint/sculpt_undo.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "124043090402698535792582219829702258639",
                "291399862714107792492370666230809677084",
                "19780911924126066182472616114708630776",
                "52788336479705262444171463252782941809",
                "180136656472081687867564524359903073902",
                "208647502420360741357835349339771405644",
                "331397288112833657229470003807514440165",
                "205577027148405797478355135906222874377"
            ]
        },
        "source": "https://github.com/blender/blender/commit/c77597cd0e15f9d7b6f963593b545cc94950eb8d",
        "signature_type": "Line",
        "id": "CVE-2022-0544-9f9ab928",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-0544.json"