Bug 2176858 (CVE-2023-1289)

Summary: CVE-2023-1289 ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jhorak
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: ImageMagick 7.1.1-0 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-03-09 17:54:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2176860, 2176861, 2176863    
Bug Blocks: 2176856    

Description Sandipan Roy 2023-03-09 14:01:17 UTC
A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.

It seems that this error affects a lot of websites and causes a generating trash files in /tmp when uploading this PC file to the server.

I think it's better to check the file descriptor coming from itself before executing read().

Security issues:
Fix commit:

Comment 1 Sandipan Roy 2023-03-09 14:02:38 UTC
Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2176860]
Affects: fedora-36 [bug 2176861]
Affects: fedora-37 [bug 2176863]

Comment 2 Product Security DevOps Team 2023-03-09 17:54:20 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):