Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff

Vulnerability

Description A tiled image crafted with a height of zero and a very large width triggers excessive CPU consumption during decoding. The image size (width times height) appears to be zero, bypassing naive size checks, but the decoder still processes many tiles or pixels because of the large width. This root cause lies in the image decoding code where the product check is insufficient.

Attack

Vector An attacker can exploit this by supplying a maliciously-crafted image file to an application that uses Go's image decoding libraries. No authentication is required; the attack can be delivered via uploaded images, email attachments, or any channel where images are processed. The bloat in width forces the decoder to allocate unnecessary resources, leading to CPU exhaustion.

Impact

Successful exploitation results in a denial-of-service (DoS) condition due to high CPU consumption. The server or client processing the image becomes unresponsive or significantly degraded. While no data is compromised, availability is severely impacted.

Mitigation

Go project has issued patches and the issue is tracked as GO-2023-1990 [2]. Affected users should update to the patched versions of the Go image package. Fedora packages have also been updated [3][4]. No workaround is known; updating is the recommended action.