Описание
ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
Summary
Specially crafted SVG file make segmentation fault and generate trash files in "/tmp", possible to leverage DoS.
Operating system, version and so on
Linux, Debian (Buster) LTS core 5.10 / Parrot OS 5.1 (Electro Ara)
Tested ImageMagick version
6.9.11-60, 7.1.0-62
Details
A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.
It seems that this error affects a lot of websites and causes a generating trash files in /tmp when uploading this PC file to the server.
I think it's better to check the file descriptor coming from itself before executing read().
PoC
- Generate SVG file:
- Run some commands for verification:
Impact
Possible DOS, because when ImageMagick crashes it generates a lot of trash files. This trash file can be large, if SVG file contains many render action.
Additional impact
In DOS attack if remount attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. This means that if an attacker uploads a 100 M SVG, the server will generate about 10 G.
Example:
P. S. If ImageMagick will work in Docker container this attack will crash server where docker running. Because the size of the docker container will increase.
Ссылки
- https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
- https://nvd.nist.gov/vuln/detail/CVE-2023-1289
- https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4
- https://bugzilla.redhat.com/show_bug.cgi?id=2176858
- https://lists.debian.org/debian-lts-announce/2024/02/msg00007.html
Пакеты
Magick.NET-Q16-AnyCPU
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-AnyCPU
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-OpenMP-arm64
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-arm64
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-x64
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-x86
<= 12.3.0
13.0.0
Magick.NET-Q16-OpenMP-arm64
<= 12.3.0
13.0.0
Magick.NET-Q16-OpenMP-x64
<= 12.3.0
13.0.0
Magick.NET-Q16-OpenMP-x86
<= 12.3.0
13.0.0
Magick.NET-Q16-arm64
<= 12.3.0
13.0.0
Magick.NET-Q16-x64
<= 12.3.0
13.0.0
Magick.NET-Q16-x86
<= 12.3.0
13.0.0
Magick.NET-Q16-HDRI-OpenMP-x64
<= 12.3.0
13.0.0
Magick.NET-Q8-AnyCPU
<= 12.3.0
13.0.0
Magick.NET-Q8-OpenMP-arm64
<= 12.3.0
13.0.0
Magick.NET-Q8-OpenMP-x64
<= 12.3.0
13.0.0
Magick.NET-Q8-arm64
<= 12.3.0
13.0.0
Magick.NET-Q8-x64
<= 12.3.0
13.0.0
Magick.NET-Q8-x86
<= 12.3.0
13.0.0
Связанные уязвимости
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
A vulnerability was discovered in ImageMagick where a specially create ...
