CVE-2018-1000222

Vulnerability

Libgd version 2.2.5 contains a double-free vulnerability in the gdImageBmpPtr function. The function calls gdImageBmpCtx without checking its return value, and then calls gdDPExtractData which can trigger a double free via the trimDynamic and gdReallocDynamic chain [3]. This affects libgd 2.2.5 and possibly earlier versions; the fix is in commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5.

Exploitation

An attacker can exploit this vulnerability by providing a specially crafted JPEG image that, when processed by an application using libgd, triggers the double-free condition. No authentication is required; the attacker only needs to entice a user or service to process the malicious image [2]. The exact sequence involves the image being decoded and then passed to gdImageBmpPtr, where the unchecked return leads to memory corruption.

Impact

Successful exploitation can result in remote code execution (RCE) or a denial of service (DoS) condition [2]. The double free can corrupt heap memory, potentially allowing an attacker to execute arbitrary code with the privileges of the process using libgd.

Mitigation

The vulnerability is fixed in libgd commit ac16bdf2d41724b5a65255d4c28fb0ec46bc42f5. Gentoo recommends upgrading to >=media-libs/gd-2.2.5-r2 [2]. No workaround is available; users should update to a patched version. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.