Denial of service via crafted TIFF image in golang.org/x/image/tiff

Root

Cause CVE-2022-41727 is a denial of service vulnerability in Go's image/tiff package. The DecodeConfig function does not properly validate TIFF image headers, allowing an attacker to craft a malformed TIFF that causes a significant memory allocation [1][2]. This is due to improper handling of integer arithmetic during tag parsing, leading to an oversized buffer allocation.

Attack

Vector An attacker can exploit this by providing a specially crafted TIFF image to any application that uses the vulnerable DecodeConfig function to process untrusted TIFF files. No authentication is required; the attack can be remote if the application accepts user-supplied images [2][3].

Impact

Successful exploitation results in memory exhaustion, leading to a denial of service condition. The affected process may crash or become unresponsive, disrupting availability [1].

Mitigation

The vulnerability is fixed in Go version 1.20.6 and 1.19.11, as well as in the golang.org/x/image module [2][3]. Users should update to patched versions. Fedora has also released updates [4].