libjxl JPEG XL Decoder resource consumption

Summaryinfo

A vulnerability was found in libjxl. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the component JPEG XL Decoder. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2024-11498. The attack can be initiated remotely. There is not any exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic has been found in libjxl (unknown version). This affects an unknown code block of the component JPEG XL Decoder. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-11498 since 11/20/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 213376 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : mozjs115 (SUSE-SU-2024:4411-1)), which helps to determine the existence of the flaw in a target environment.

Applying the patch 65fbec56bc578b6b6ee02a527be70787bbd053b0 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (213376). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• libjxl

Website

• Product: https://github.com/libjxl/libjxl/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion