CVE-2024-24792 Panic when parsing invalid palette-color images in golang.org/x/image
Attackers can cause a denial of service by providing malicious TIFF images with invalid color indices to applications using the Go image library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24792?
CVE-2024-24792 is a high-severity denial of service vulnerability in golang.org/x/image/tiff, published on 27 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parsing a corrupt or malicious image with invalid color indices can cause a panic.
Which versions are affected by CVE-2024-24792?
3 open source packages ship an affected version, including golang.org/x/image.
| Package | Affected | Fixed in |
|---|---|---|
golang.org/x/image Go | All versions | 0.18.0 |
golang.org/x/image Go | All versions | 0.18.0 |
golang.org/x/image Go | All versions | 0.18.0 |
Linux distribution packages (6)
keybase-client SUSE:Package Hub 15 SP5 | All versions | 6.2.8-bp156.2.6.1 |
keybase-client SUSE:Package Hub 15 SP6 | All versions | 6.2.8-bp156.2.6.1 |
keybase-client openSUSE:Leap 15.5 | All versions | 6.2.8-bp156.2.6.1 |
keybase-client openSUSE:Leap 15.6 | All versions | 6.2.8-bp156.2.6.1 |
gomuks openSUSE:Tumbleweed | All versions | 0.3.0-3.1 |
keybase-client openSUSE:Tumbleweed | All versions | 6.3.1-2.1 |
How do I fix CVE-2024-24792?
Upgrade golang.org/x/image to 0.18.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-24792 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24792 exists.
Sources
Also known as DEBIAN-CVE-2024-24792, GHSA-9phm-fm57-rhg8, GO-2024-2937, UBUNTU-CVE-2024-24792, openSUSE-SU-2024:0224-2, openSUSE-SU-2024:14099-1 and 1 more.