CVE-2020-36332
📋 TL;DR
CVE-2020-36332 is a memory exhaustion vulnerability in libwebp library versions before 1.0.1. When processing specially crafted WebP images, libwebp allocates excessive memory, potentially causing denial of service through application crashes or system resource exhaustion. This affects any application or service that uses vulnerable libwebp versions for WebP image processing.
💻 Affected Systems
- libwebp
- Applications using libwebp (Chrome, Firefox, various image processing tools)
- Operating systems with vulnerable libwebp packages
📦 What is this software?
Libwebp by Webmproject
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through memory exhaustion leading to application crashes, system instability, or denial of service across affected systems.
Likely Case
Application crashes or hangs when processing malicious WebP images, causing temporary service disruption.
If Mitigated
Limited impact with proper memory limits and monitoring; potential isolated application crashes without system-wide effects.
🎯 Exploit Status
Exploitation requires crafting a malicious WebP image that triggers the memory allocation issue. The vulnerability is publicly documented with proof-of-concept examples available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libwebp 1.0.1 and later
Vendor Advisory: https://security.netapp.com/advisory/ntap-20211104-0004/
Restart Required: Yes
Instructions:
1. Update libwebp to version 1.0.1 or later using your system package manager. 2. For Linux: Use 'sudo apt update && sudo apt upgrade libwebp' (Debian/Ubuntu) or 'sudo yum update libwebp' (RHEL/CentOS). 3. Restart affected applications or services. 4. For embedded applications, recompile with patched libwebp library.
🔧 Temporary Workarounds
Disable WebP processing
allTemporarily disable WebP image processing in applications if possible
Application-specific configuration changes required
Implement memory limits
linuxSet memory limits for applications processing images
ulimit -v [memory_limit_in_kb] (Linux)
Use cgroups or container memory limits
🧯 If You Can't Patch
- Implement strict input validation for image uploads and reject suspicious WebP files
- Deploy memory monitoring and alerting for applications processing images to detect exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check libwebp version: 'libwebp --version' or 'dpkg -l | grep libwebp' (Debian) or 'rpm -qa | grep libwebp' (RHEL)Check Version:
libwebp --version 2>/dev/null || dpkg -l libwebp* 2>/dev/null || rpm -q libwebp 2>/dev/nullVerify Fix Applied:
Verify libwebp version is 1.0.1 or later using version check commands📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory allocation errors
- High memory usage spikes in image processing applications
- Kernel OOM (Out of Memory) killer logs
Network Indicators:
- Unusual uploads of WebP images to web applications
- Multiple failed image processing requests
SIEM Query:
source="application.logs" AND ("out of memory" OR "malloc failed" OR "segmentation fault") AND process="*image*"🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1956868
- https://security.netapp.com/advisory/ntap-20211104-0004/
- https://www.debian.org/security/2021/dsa-4930
- https://bugzilla.redhat.com/show_bug.cgi?id=1956868
- https://security.netapp.com/advisory/ntap-20211104-0004/
- https://www.debian.org/security/2021/dsa-4930
