Login Sign Up

CVE-2021-28276

7.5 HIGH
Denial of Service

📋 TL;DR

CVE-2021-28276 is a Denial of Service vulnerability in jhead image metadata processing software. It allows attackers to crash applications using jhead via a wild address read when processing specially crafted Canon MakerNote metadata in image files. Users and systems processing untrusted image files with jhead 3.04-3.05 are affected.

💻 Affected Systems

Products:
  • jhead
Versions: 3.04 through 3.05
Operating Systems: Linux, Windows, macOS, BSD
Default Config Vulnerable: ⚠️ Yes
Notes: Any application or script that uses jhead to process image files is vulnerable when handling untrusted input.

📦 What is this software?

Jhead by Jhead Project

View all CVEs affecting Jhead →

Jhead by Jhead Project

View all CVEs affecting Jhead →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete application crash leading to denial of service for any service using jhead to process images, potentially disrupting image processing pipelines or web applications.

🟠

Likely Case

Application crash when processing malicious image files, causing temporary service disruption until the process restarts.

🟢

If Mitigated

Minimal impact if jhead is not exposed to untrusted input or runs in isolated containers with automatic restart.

🌐 Internet-Facing: MEDIUM - Web applications accepting image uploads and using jhead for processing could be disrupted, but impact is limited to DoS rather than data compromise.
🏢 Internal Only: LOW - Internal systems processing trusted images have minimal exposure, though malicious insiders could still trigger crashes.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires only a specially crafted image file. The vulnerability is publicly documented with proof-of-concept details available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.06 and later

Vendor Advisory: https://github.com/Matthias-Wandel/jhead/issues/1

Restart Required: No

Instructions:

1. Download jhead 3.06 or later from https://github.com/Matthias-Wandel/jhead/releases. 2. Compile and install according to platform instructions. 3. Replace existing jhead binary with new version.

🔧 Temporary Workarounds

Input validation and sandboxing

linux

Validate image files before processing with jhead and run jhead in isolated containers or sandboxes.

docker run --read-only --tmpfs /tmp:rw,noexec,nosuid -v /safe/images:/input:ro jhead-processor

Disable jhead processing for untrusted sources

all

Temporarily disable jhead usage for processing images from untrusted sources until patched.

🧯 If You Can't Patch

  • Implement strict input validation to reject suspicious image files before jhead processing
  • Run jhead in isolated containers with resource limits and automatic restart policies

🔍 How to Verify

Check if Vulnerable:

Run 'jhead -V' to check version. If output shows 3.04 or 3.05, system is vulnerable.

Check Version:

jhead -V

Verify Fix Applied:

After updating, run 'jhead -V' and confirm version is 3.06 or higher. Test with known safe image files to ensure functionality.

📡 Detection & Monitoring

Log Indicators:

  • Application crashes or segmentation faults when processing image files
  • Abnormal process termination of jhead or applications calling jhead

Network Indicators:

  • Multiple failed image uploads followed by service disruption
  • Unusual patterns of image file submissions to web applications

SIEM Query:

process_name:"jhead" AND (event_type:"crash" OR exit_code:139)

📊 Metadata

CVE ID: CVE-2021-28276
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: March 23, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON