There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc.

Product: JPEG XL / libjxl Affected: libjxl versions before 0.8.1 CVE: CVE-2023-0645 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: 9.1 CRITICAL (NVD: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) CVSS 3.1: 5.3 MEDIUM (CNA/Google: AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Reporter: sigdevel <https://infosec.exchange/@sigdevel> / Alexander A. Shvedov

Description: An out-of-bounds read exists in libjxl when parsing EXIF metadata. A crafted JPEG file processed through cjxl can make jxl::FindExifTagPosition() read the number of EXIF tags from a pointer that is outside the EXIF buffer.

Cjxl reads a 94120-byte JPEG input and then crashes while doing lossless JPEG transcoding. The crash happens in lib/jxl/exif.h when FindExifTagPosition() evaluates the EXIF tag count:

uint16t nbtags = (bigendian ? LoadBE16(t) : LoadLE16(t));

The backtrace from the upstream issue shows the following path:

jxl::FindExifTagPosition() jxl::InterpretExif() JxlEncoderAddJPEGFrame() jxl::extras::EncodeImageJXL() main()

The bug is caused by insufficient validation that the t pointer still points inside the EXIF buffer before reading nbtags. This can be triggered by an attacker-controlled input file and results in a segmentation fault / abnormal process termination. Depending on the caller, this can be used for denial of service.

Reproduction: The upstream issue used the following command:

cjxl sig11src000122poc --disableoutput

Reported output:

JPEG XL encoder v0.9.0 aa99c8d8 [AVX2,SSE4,SSSE3,Unknown] Read JPEG image with 94120 bytes. Encoding [Container | JPEG, lossless transcode, effort: 7 | JPEG reconstruction data], Segmentation fault (core dumped)

Fix: The fix adds bounds checking before the EXIF tag count is read, ensuring that the t pointer is still within the EXIF buffer. The issue was fixed upstream through PR #2101 and is included in libjxl 0.8.1. Users should upgrade to version 0.8.1 or later, or apply the referenced upstream fix commit. PoC: https://github.com/sigdevel/pocs/blob/main/res/libjxl/20220125/sig11src000122poc References: https://nvd.nist.gov/vuln/detail/CVE-2023-0645 https://github.com/libjxl/libjxl/issues/2100 https://github.com/libjxl/libjxl/pull/2101 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159

——