CVE-2021-27922

Root

Cause

Pillow, the Python Imaging Library fork, contains a denial-of-service vulnerability in its handling of ICNS (Apple Icon Image) container files. The library does not properly check the reported size of a contained image within an ICNS container [1]. This allows an attacker to craft a malicious ICNS file that advertises an extremely large image dimension, causing Pillow to attempt an enormous memory allocation [1][2].

Attack

Vector

An attacker can exploit this issue by providing a specially crafted ICNS image file to an application that uses Pillow to process it. No authentication is required; the attack is triggered simply by the application attempting to open or decode the malicious file [1]. The vulnerability is present in all versions of Pillow before 8.1.2 [1][2][3].

Impact

Successful exploitation leads to uncontrolled memory consumption, potentially exhausting system resources and resulting in a denial of service (DoS) condition for the affected application or the entire host [1][3]. This can cause the application to crash or become unresponsive, disrupting services that rely on Pillow's image processing capabilities.

Mitigation

The vulnerability was patched in Pillow version 8.1.2 [1][2]. Users should upgrade to Pillow 8.1.2 or later. For users unable to upgrade, there is no known workaround [3]. The Gentoo security advisory (GLSA 202107-33) also lists this CVE and recommends upgrading to >=8.2.0 [3]. Additionally, Fedora package announcements have informed users of the fix [4].