Bug 2176858 (CVE-2023-1289)

Summary:	CVE-2023-1289 ImageMagick: Specially crafted SVG leads to segmentation fault and generate trash files in "/tmp", possible to leverage DoS
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jhorak
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ImageMagick 7.1.1-0	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-03-09 17:54:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2176860, 2176861, 2176863
Bug Blocks:	2176856

Description Sandipan Roy 2023-03-09 14:01:17 UTC

A specially created SVG file that loads by itself and make segmentation fault. Remote attackers can take advantage of this vulnerability to cause a denial of service of the generated SVG file.

It seems that this error affects a lot of websites and causes a generating trash files in /tmp when uploading this PC file to the server.

I think it's better to check the file descriptor coming from itself before executing read().

Refeners:
Security issues:
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
Fix commit:
https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4

Comment 1 Sandipan Roy 2023-03-09 14:02:38 UTC

Created ImageMagick tracking bugs for this issue:

Affects: epel-8 [bug 2176860]
Affects: fedora-36 [bug 2176861]
Affects: fedora-37 [bug 2176863]

Comment 2 Product Security DevOps Team 2023-03-09 17:54:20 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-1289