Listen to this Post
A vulnerability exists in Pillow’s GIF image plugin where the `GifImageFile._seek()` method validates a frame’s enlarged dimensions against decompression bomb limits only after mutating the image’s `self._size` attribute. When an application catches the resulting `DecompressionBombError` and continues processing the same image object, the object retains the oversized dimensions while holding the original, smaller pixel buffer. Subsequent operations such as im.load(), im.rotate(), or creating new images based on `im.size` allocate gigabytes of memory based on the stale dimensions, leading to excessive memory exhaustion, MemoryError, or an out-of-memory (OOM) process termination.
DailyCVE Form:
Platform: Pillow
Version: < 10.x
Vulnerability : DoS
Severity: Low
date: 2024
Prediction: Available
What Undercode Say
python3 -c "from PIL import Image; im = Image.open('exploit.gif'); im.seek(1)"
Exploit: (Educational Purposes!)
An attacker uploads a malformed GIF file containing an animation frame descriptor with inflated width and height values (e.g., 40000×40000). When vulnerable applications step through frames and catch the DecompressionBombError, the image object is poisoned with the oversized dimensions. Any subsequent retry or buffer allocation operation using `im.size` triggers massive unintended memory allocation, exhausting system memory.
Protection: from this CVE
Upgrade Pillow to a patched version where frame extents and decompression bomb checks are validated into local variables and checked before mutating self._size. Ensure applications do not reuse image objects that have thrown decompression bomb exceptions.
Impact:
Remote attackers can cause a Denial of Service (DoS) by exhausting server memory through crafted GIF uploads, leading to worker crashes or application-wide resource starvation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
