ImageMagick, Memory Leak Vulnerability, CVE-2024-XXXX (Low)

Listen to this Post

🐢▶️ Listen🚀

The vulnerability exists in the `LoadOpenCLDeviceBenchmark()` function within MagickCore/opencl.c. When parsing an OpenCL device profile XML file, the function allocates a `MagickCLDeviceBenchmark` structure and assigns string attributes (platform_name, vendor_name, name, version) using ConstantString(). These string allocations occur when a `` closing tag is subsequently parsed. If a malformed XML file contains a `Prediction: Patch TBD

What Undercode Say:

./configure CFLAGS="-g -O0 -fsanitize=address" LDFLAGS="-fsanitize=address"
make -j$(nproc)
cp malformed.xml ~/.cache/ImageMagick/
export ASAN_OPTIONS="detect_leaks=1"
./utilities/magick xc:red output.png

How Exploit:

Local file placement.

Malformed XML trigger.

Repeated process invocation.

Protection from this CVE

Update ImageMagick version.

Validate OpenCL cache files.

Disable OpenCL if unused.

Impact:

Resource exhaustion.

Local DoS potential.

Low severity risk.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin