CVE-2020-25663: Use After Free

Q: Who is exposed to this issue?

Systems that process attacker-supplied image files with affected ImageMagick versions are exposed. Exploitation requires a local attack vector and user interaction, according to the CVSS vector.

Q: What does an attacker need to do to trigger the flaw?

An attacker needs to provide a malicious image file that is processed by ImageMagick. The vulnerable path involves SetImageAlphaChannel() and pixel color access through GetPixelRed() or GetPixelBlue().

Q: What is the expected impact?

The reported impact is denial of service through a heap-use-after-free or heap-buffer-overflow read. The available information says further exploitation is unlikely because the affected memory is used as pixel data rather than a function pointer.

Q: Which versions need remediation?

The flaw affects ImageMagick versions prior to 7.0.9-0. A patch is available.

Published Oct 26, 2020

Updated

A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed() or GetPixelBlue() was called. This could occur if an attacker is able to submit a malicious image file to be processed by ImageMagick and could lead to denial of service. It likely would not lead to anything further because the memory is used as pixel data and not e.g. a function pointer. This flaw affects ImageMagick versions prior to 7.0.9-0.

Other sources

In ImageMagick, there is a heap-use-after-free at MagickCore/pixel-accessor.h:378:10 in GetPixelRed.

Reference: https://github.com/ImageMagick/ImageMagick/issues/1723

— Red Hat

Affected Software

2 affected componentsFixes available

redhat/ImageMagick 7.0.9<0

ImageMagick<7.0.8-56

Remediation

Patch Available

https://bugzilla.redhat.com/show_bug.cgi?id=1891601

Event History

Dec 8, 2020

CVE Published

via MITRE·08:57 PM

Data Sourced

via MITRE·08:57 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Systems that process attacker-supplied image files with affected ImageMagick versions are exposed. Exploitation requires a local attack vector and user interaction, according to the CVSS vector.

What does an attacker need to do to trigger the flaw?

An attacker needs to provide a malicious image file that is processed by ImageMagick. The vulnerable path involves SetImageAlphaChannel() and pixel color access through GetPixelRed() or GetPixelBlue().

What is the expected impact?

The reported impact is denial of service through a heap-use-after-free or heap-buffer-overflow read. The available information says further exploitation is unlikely because the affected memory is used as pixel data rather than a function pointer.

Which versions need remediation?

The flaw affects ImageMagick versions prior to 7.0.9-0. A patch is available.

CVE-2020-25663: Use After Free

Other sources

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the expected impact?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the flaw?

What is the expected impact?

Which versions need remediation?