CVE-2022-48541
Description
A flaw was found in ImageMagick, which susceptible to a Missing Release of Memory after the Effective Lifetime vulnerability is triggered by the 'identify -help' command. This issue could allow an attacker to initiate a denial of service attack by inducing a memory leak.
Statement
The identified flaw in ImageMagick, presenting a "Missing Release of Memory" vulnerability triggered by the 'identify -help' command, carries a moderate severity rating due to its potential impact on system stability and resource consumption. While the vulnerability could lead to a denial of service condition by inducing memory leaks, its exploitation requires specific user interaction with the affected command. Furthermore, successful exploitation does not inherently grant unauthorized access or execution of arbitrary code. However, in scenarios where the affected command is publicly accessible or invoked frequently, such as in web applications processing user-uploaded images, the risk of exploitation and consequent disruption to service availability elevates.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | 7.1 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Red Hat CVSS v3 Score Explanation
UI:R (User Interaction Required) indicates that successful exploitation of the vulnerability necessitates user interaction. In this scenario, an attacker would need to persuade a user or administrator to execute the specific 'identify -help' command, which triggers the vulnerability.
I:L (Integrity Impact: Low) suggests that the vulnerability's exploitation would have minimal impact on data integrity. Since this vulnerability primarily leads to a denial of service condition by inducing memory leaks, it is unlikely to directly compromise or modify data processed or stored by ImageMagick.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Most memory leaks result in general product reliability problems, but if an attacker can intentionally trigger a memory leak, the attacker might be able to launch a denial of service attack (by crashing or hanging the program) or take advantage of other unexpected program behavior resulting from a low memory condition.
Other
Technical Impact: Reduce Performance
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
