Skip to content

x/image/tiff: excessive CPU consumption from no-op loop iterations [CVE-2023-29407] #61581

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom
Closed
neild opened this issue Jul 25, 2023 · 1 comment
Closed

x/image/tiff: excessive CPU consumption from no-op loop iterations [CVE-2023-29407] #61581

neild opened this issue Jul 25, 2023 · 1 comment
Assignees
@neild
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. Security
Milestone
Unreleased

Comments

@neild
Copy link
Contributor

neild commented Jul 25, 2023 •
edited
Loading

Decoding a 0-height tiled TIFF image iterates over every horizontal pixel. A maliciously-crafted 0-height, max-width image can force 2^32 loop iterations and a substantial amount of CPU consumption.

Thanks to Philippe Antoine (Catena cyber) for reporting this issue.

This is CVE-2023-29407.

This is a PRIVATE issue for CVE-2023-29407, tracked in http://b/279483698 and fixed by http://tg/1944079.

/cc @golang/security and @golang/release
@neild neild added Security NeedsFix The path to resolution is known, but the work has not been done. labels Jul 25, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/514897 mentions this issue: tiff: limit work when decoding malicious images

@neild neild changed the title security: fix CVE-2023-29407 image/tiff: excessive CPU consumption from 2^32 no-op loop iterations Aug 1, 2023
@neild neild changed the title image/tiff: excessive CPU consumption from 2^32 no-op loop iterations image/tiff: excessive CPU consumption from no-op loop iterations [CVE-2023-29407] Aug 1, 2023
@neild neild self-assigned this Aug 1, 2023
@dmitshur dmitshur changed the title image/tiff: excessive CPU consumption from no-op loop iterations [CVE-2023-29407] x/image/tiff: excessive CPU consumption from no-op loop iterations [CVE-2023-29407] Aug 2, 2023
@dmitshur dmitshur added this to the Unreleased milestone Aug 2, 2023
@golang golang locked and limited conversation to collaborators Aug 1, 2024
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Assignees

@neild neild

Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. Security
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
3 participants
@neild @dmitshur @gopherbot