CVE-2021-37621: Denial of service due to infinite loop in Image::printIFDStructure
Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (-p C). The bug is fixed in version v0.27.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Exiv2to a version that resolves this vulnerability.Fixed in v0.27.5 - Configuration
Avoid triggering the infinite loop by not using the extra command line option '-p C' to print the image ICC profile with Exiv2, until upgraded to v0.27.5.
Exiv2 (command-line) ICC profile printing option = -p C (do not use) - Compensating control
If Exiv2 must be used, ensure it is only run on trusted image files (and not attacker-supplied crafted images) to prevent exploitation that triggers the infinite loop when printing ICC profile metadata.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-37621?
CVE-2021-37621 has a severity rating classified as medium due to the potential for an infinite loop leading to resource consumption.
How do I fix CVE-2021-37621?
To fix CVE-2021-37621, users should upgrade Exiv2 to version 0.27.5 or later where the vulnerability is addressed.
What versions are affected by CVE-2021-37621?
CVE-2021-37621 affects Exiv2 versions up to and including 0.27.4 and certain versions of Fedora and Debian Linux.
What types of attacks can exploit CVE-2021-37621?
CVE-2021-37621 can be exploited by providing a crafted image file that triggers the infinite loop when its metadata is accessed.
Is CVE-2021-37621 a remote or local vulnerability?
CVE-2021-37621 can be considered a local vulnerability, as it requires local access to run the Exiv2 utility on a crafted image.