CVE-2021-29390
📋 TL;DR
CVE-2021-29390 is a heap-based buffer over-read vulnerability in libjpeg-turbo's decompress_smooth_data function that allows reading 2 bytes beyond allocated memory boundaries. This affects any application using libjpeg-turbo version 2.0.90 to process JPEG images, potentially leading to information disclosure or denial of service.
💻 Affected Systems
- libjpeg-turbo
- Any software using libjpeg-turbo library
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Libjpeg Turbo by Libjpeg Turbo
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through memory corruption leading to complete system compromise, though this is unlikely given the limited 2-byte over-read.
Likely Case
Application crash (denial of service) or information disclosure of adjacent memory contents when processing malicious JPEG files.
If Mitigated
Limited impact with proper memory protections (ASLR, DEP) and sandboxing, typically resulting in application termination only.
🎯 Exploit Status
Exploitation requires crafting a specific JPEG file that triggers the buffer over-read; no public exploits have been documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libjpeg-turbo 2.0.91 and later
Vendor Advisory: https://github.com/libjpeg-turbo/libjpeg-turbo/security/advisories/GHSA-5-3-3-3-3
Restart Required: Yes
Instructions:
1. Update libjpeg-turbo to version 2.0.91 or later using your package manager. 2. Restart all applications using libjpeg-turbo. 3. Rebuild any statically linked applications with the updated library.
🔧 Temporary Workarounds
Disable JPEG processing
allTemporarily disable JPEG image processing in affected applications until patching is possible
Use alternative JPEG library
linuxConfigure applications to use alternative JPEG libraries like libjpeg instead of libjpeg-turbo
sudo apt-get install libjpeg-dev
Reconfigure applications to link against libjpeg instead of libjpeg-turbo
🧯 If You Can't Patch
- Implement strict input validation for JPEG files before processing
- Run applications with memory protection features (ASLR, DEP) enabled and in sandboxed environments
🔍 How to Verify
Check if Vulnerable:
Check libjpeg-turbo version: `dpkg -l | grep libjpeg-turbo` or `rpm -qa | grep libjpeg-turbo` or `libjpeg-turbo --version`Check Version:
libjpeg-turbo --version 2>&1 | head -1Verify Fix Applied:
Confirm version is 2.0.91 or later: `libjpeg-turbo --version | grep -q '2\.0\.9[1-9]\|2\.[1-9]\|3\.' && echo 'Patched'`📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults when processing JPEG files
- Memory access violation errors in application logs
Network Indicators:
- Unusual JPEG file uploads to web applications
- Repeated failed image processing requests
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "access violation") AND "jpeg"🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1943797
- https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
- https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
- https://bugzilla.redhat.com/show_bug.cgi?id=1943797
- https://github.com/libjpeg-turbo/libjpeg-turbo/blob/4e52b66f342a803d3b8099b79607e3158d3a241c/jdcoefct.c#L595
- https://github.com/libjpeg-turbo/libjpeg-turbo/commits/main/jdcoefct.c
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/27NR3KG553CG6LGPMP6SHWEVHTYPL6RC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
