Denial of service in Perl Imager before 1.037 via out-of-range raw image channel count
AI analysis
Imager, a Perl image-processing library, fails to validate the raw_datachannels field when reading a 'raw' format image in i_readraw_wiol, in all versions before 1.037. The value is used to size a line buffer as image width times channel count with no range or overflow check, so a negative or very large count requests an excessive allocation; when that allocation fails, Imager's internal allocator calls exit(3), terminating the entire Perl process in a way the application cannot catch or trap. An attacker triggers the flaw by getting an application that feeds untrusted files to Imager->read() to process a crafted raw image with a malicious raw_datachannels value, yielding a straightforward denial of service against services such as web apps that accept and process image uploads. Any deployment using Imager before 1.037 that reads raw-format images from untrusted sources is affected. The vulnerability has no CVSS score yet, no public proof of concept, is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild.
What to do: Upgrade Imager to version 1.037 or later, which range-checks raw_datachannels. Until then, do not pass untrusted files to Imager->read() as the raw format: restrict uploads to well-known, validated formats such as JPEG, PNG, or GIF before processing. Audit Perl code for Imager->read() calls on user-supplied input, and note the failure mode is an uncatchable exit(3), so ensure process supervision (e.g., prefork/restart) is in place for affected services.
Affected
| Imager project (CPAN / Perl) Imager | before 1.037 |
Estimated exposure
nicheplausibly hundreds to low thousands of Perl-based servers/apps, i.e. a small subset of Imager users — Imager is a well-known CPAN image-processing module used in Perl web applications, but no install counts are published and the bug only fires when reading the uncommon 'raw' image format from untrusted input, which sharply limits the…
Description
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an untrusted raw_datachannels value to Imager->read() triggers an uncatchable exit.