CVE-2022-32545 – This CVE-2022-32545 is an integer overflow vuln... (How to Fix)

Q: What is the severity of CVE-2022-32545?

CVE-2022-32545 has a CVSS score of 7.8 (HIGH). This CVE-2022-32545 is an integer overflow vulnerability in ImageMagick's PSD file parser. When processing specially crafted or untrusted PSD files, it can cause undefined behavior leading to application crashes or potential code execution. Any system using vulnerable ImageMagick versions to process untrusted image files is affected.

📋 TL;DR

This CVE-2022-32545 is an integer overflow vulnerability in ImageMagick's PSD file parser. When processing specially crafted or untrusted PSD files, it can cause undefined behavior leading to application crashes or potential code execution. Any system using vulnerable ImageMagick versions to process untrusted image files is affected.

💻 Affected Systems

Products:

ImageMagick
ImageMagick6

Versions: ImageMagick versions before 7.1.0-39 and ImageMagick6 versions before 6.9.12-39

Operating Systems: All operating systems running vulnerable ImageMagick versions

Default Config Vulnerable: ⚠️ Yes

Notes: Any application or service using ImageMagick to process PSD files is vulnerable. This includes web applications, document processing systems, and image conversion services.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise if the integer overflow can be leveraged for memory corruption attacks.

🟠

Likely Case

Application denial of service through crashes when processing malicious PSD files, potentially disrupting image processing services.

🟢

If Mitigated

Limited to application crashes with proper sandboxing and input validation in place.

🌐 Internet-Facing: HIGH - Image processing services accepting user uploads are directly exposed to crafted PSD files.

🏢 Internal Only: MEDIUM - Internal systems processing PSD files from untrusted sources remain vulnerable.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting a malicious PSD file. While no public PoC exists, the vulnerability is in file parsing code that processes untrusted input.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: ImageMagick 7.1.0-39 and ImageMagick6 6.9.12-39

Vendor Advisory: https://github.com/ImageMagick/ImageMagick/commit/9c9a84cec4ab28ee0b57c2b9266d6fbe68183512

Restart Required: Yes

Instructions:

1. Update ImageMagick using your package manager: 'sudo apt update && sudo apt upgrade imagemagick' (Debian/Ubuntu) or 'sudo yum update imagemagick' (RHEL/CentOS). 2. Restart any services using ImageMagick. 3. Verify the update with 'convert --version'.

🔧 Temporary Workarounds

Disable PSD format support

linux

Remove PSD format from ImageMagick's supported formats to prevent processing of malicious PSD files

Edit /etc/ImageMagick-6/policy.xml or /etc/ImageMagick-7/policy.xml
Add: <policy domain="coder" rights="none" pattern="PSD" />

Input validation and sandboxing

all

Implement strict input validation for uploaded files and run ImageMagick in restricted environments

Implement file type verification before processing
Use chroot or containerization for ImageMagick processes

🧯 If You Can't Patch

Implement strict file upload validation to reject PSD files from untrusted sources
Isolate ImageMagick processing to dedicated, restricted environments with minimal privileges

🔍 How to Verify

Check if Vulnerable:

Check ImageMagick version with 'convert --version' or 'magick --version'. If version is below 7.1.0-39 (ImageMagick7) or 6.9.12-39 (ImageMagick6), system is vulnerable.

Check Version:

convert --version | head -1

Verify Fix Applied:

After patching, verify version is 7.1.0-39 or higher (ImageMagick7) or 6.9.12-39 or higher (ImageMagick6) using 'convert --version'.

📡 Detection & Monitoring

Log Indicators:

ImageMagick process crashes or segmentation faults when processing PSD files
Error messages containing 'coders/psd.c' or 'unsigned char' overflow

Network Indicators:

Unusual uploads of PSD files to image processing endpoints
Multiple failed image processing attempts

SIEM Query:

process.name:"convert" AND (event.action:"segmentation fault" OR event.action:"crash") AND file.extension:"psd"

📊 Metadata

CVE ID: CVE-2022-32545

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-190

Published: June 16, 2022

Last Updated: November 21, 2024

🔗 References

https://bugzilla.redhat.com/show_bug.cgi?id=2091811 Issue Tracking,Patch,Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/9c9a84cec4ab28ee0b57c2b9266d6fbe68183512 Patch,Third Party Advisory
https://github.com/ImageMagick/ImageMagick6/commit/450949ed017f009b399c937cf362f0058eacc5fa Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
https://bugzilla.redhat.com/show_bug.cgi?id=2091811 Issue Tracking,Patch,Third Party Advisory
https://github.com/ImageMagick/ImageMagick/commit/9c9a84cec4ab28ee0b57c2b9266d6fbe68183512 Patch,Third Party Advisory
https://github.com/ImageMagick/ImageMagick6/commit/450949ed017f009b399c937cf362f0058eacc5fa Patch,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-32545, you might also want to check these: