Deadlock in libheif - #VU158745

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by indefinitely blocking image decoding.

The vulnerability exists due to incorrect handling of unfilled tile queue entries in libheif's ImageItem_Grid::decode_full_grid_image() when decoding grid images in parallel with non-strict decoding options. A remote attacker can supply a crafted HEIF file containing skipped tiles and an unreferenced item 0 with cyclic alpha-image references to trigger unintended decoding of that item, causing worker threads to acquire image decode mutexes in opposite orders and deadlock.

The hang requires at least two tile-decoding threads.

Affected software

Remediation

External References

• https://github.com/strukturag/libheif/security/advisories/GHSA-rcqc-842v-m26h
• https://github.com/strukturag/libheif/commit/4b12fc8d6e0ee8b52f100ade37d2f179ce821aaa

Related Security Bulletins

• Multiple vulnerabilities in libheif