CVE-2019-16249

Vulnerability

Overview

CVE-2019-16249 is an out-of-bounds read vulnerability in OpenCV 4.1.1, specifically in the hal_baseline::v_load function within core/hal/intrin_sse.hpp. This function is called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp, which is part of the DIS optical flow algorithm [3]. The root cause is that the code does not properly validate buffer boundaries when loading data via SSE instructions, allowing reads beyond an allocated memory region [4].

Exploitation

Conditions

To exploit this vulnerability, an attacker must supply crafted input (e.g., video frames or images) to an application using OpenCV's DIS optical flow functionality. No authentication is required if the input is user-controlled. The issue manifests during the computation of the sum of squared differences (SSD) with mean normalization, which occurs in a multi-threaded parallel region [3].

Impact

An out-of-bounds read can cause the application to crash (denial of service) or leak sensitive memory contents, depending on how the read data is used [4]. In the context of OpenCV, this could expose image data or other information from adjacent memory.

Mitigation

The vulnerability has been fixed in OpenCV version 4.1.2 and later, as well as in the commit merged via pull request #15531 [2]. Users are advised to update their OpenCV installation to a patched version. There are no known workarounds other than avoiding the use of DIS optical flow with untrusted input until the update is applied.