CVE-2017-18029

Vulnerability

A memory leak vulnerability exists in the ReadMATImage function in coders/mat.c of ImageMagick 7.0.6-10 Q16. When processing a specially crafted MATLAB image file, the function fails to properly free allocated memory, leading to a memory leak [2]. The vulnerability is reachable without special privileges, requiring only that a user or automated system opens the malicious file using ImageMagick utilities such as identify [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious .mat file that triggers the memory leak when processed. No authentication or network position is required beyond delivering the file to the target; user interaction is necessary for the victim to open the file (e.g., via identify or other ImageMagick commands) [2]. The leak is detected via AddressSanitizer, confirming the flaw [2].

Impact

Successful exploitation results in a denial of service via memory exhaustion, as the memory leak accumulates over time. Under certain conditions, the Ubuntu security advisory notes that this could potentially lead to code execution with the privileges of the user running ImageMagick [1][2]. However, the CVE specifically identifies the direct impact as denial of service.

Mitigation

The vulnerability is fixed in later versions of ImageMagick. Canonical released Ubuntu Security Notice USN-3681-1 on July 10, 2018, which includes updated packages for Ubuntu 18.04 LTS and other supported releases [1]. Users should upgrade to the corrected package versions listed in the advisory (e.g., 8:6.9.7.4+dfsg-16ubuntu6.10 for Ubuntu 18.04). No workaround is available; updating is the recommended course of action [1].