Memory Leak in ImageMagick via OpenCL XML Parsing

Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-13. It is a memory leak in the LoadOpenCLDeviceBenchmark() function that occurs when the software parses malformed OpenCL device profile XML files containing unclosed device elements.

Attackers who have write access to the OpenCL cache directory can exploit this by placing malicious XML files designed to exhaust memory, which can lead to a denial of service condition.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a memory leak in ImageMagick's LoadOpenCLDeviceBenchmark() function when parsing malformed OpenCL device profile XML files with unclosed <device> elements. Detection involves checking for the presence of such malformed XML files in the OpenCL cache directory, typically located at ~/.cache/ImageMagick/.

Since the exploit requires write access to the OpenCL cache directory to place malicious XML files, monitoring this directory for unexpected or suspicious XML files with unclosed <device> tags can help detect potential exploitation attempts.

Suggested commands to detect suspicious files include:

• List XML files in the OpenCL cache directory: ls -l ~/.cache/ImageMagick/*.xml
• Search for unclosed <device> tags in XML files: grep -L '/>' ~/.cache/ImageMagick/*.xml | xargs grep '<device'
• Monitor memory usage of ImageMagick processes to detect abnormal memory growth that could indicate a memory leak: top or ps aux | grep ImageMagick

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS) attack. An attacker with write access to the OpenCL cache directory can cause the application to consume excessive memory by exploiting the memory leak, potentially causing the system or application to crash or become unresponsive.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this memory leak vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, the primary step is to upgrade ImageMagick to version 7.1.2-13 or later, where the memory leak issue in LoadOpenCLDeviceBenchmark() has been fixed.

Additionally, restrict write access to the OpenCL cache directory (~/.cache/ImageMagick/) to trusted users only, preventing attackers from placing malicious malformed XML files.

Regularly monitor and clean the OpenCL cache directory to remove any suspicious or malformed XML files.

Useful 0 Not Useful 0